多用户系统是能够同时且独立地执行属于两个或多个用户的多个应用程序的计算机。 并发是指应用程序可以同时处于活动状态并争夺CPU、内存、硬盘等各种资源。独立地 意味着每个应用程序都可以执行其任务，而无需关心其他用户的应用程序正在做什么。当然，从一个应用程序切换到另一个应用程序会减慢每个应用程序的速度并影响用户看到的响应时间。我们将在本书中研究现代操作系统内核的许多复杂性，它们的存在是为了最大限度地减少每个程序的延迟，并为用户提供尽可能快的响应。

A multiuser system is a computer that is able to concurrently and independently execute several applications belonging to two or more users. Concurrently means that applications can be active at the same time and contend for the various resources such as CPU, memory, hard disks, and so on. Independently means that each application can perform its task with no concern for what the applications of the other users are doing. Switching from one application to another, of course, slows down each of them and affects the response time seen by the users. Many of the complexities of modern operating system kernels, which we will examine in this book, are present to minimize the delays enforced on each program and to provide the user with responses that are as fast as possible.

多用户操作系统必须包含以下几个功能：

Multiuser operating systems must include several features:

为了确保安全的保护机制，操作系统必须使用与CPU特权模式相关的硬件保护。否则，用户程序将能够直接访问系统电路并克服强加的限制。Unix 是一个多用户系统，对系统资源实施硬件保护。

To ensure safe protection mechanisms, operating systems must use the hardware protection associated with the CPU privileged mode. Otherwise, a user program would be able to directly access the system circuitry and overcome the imposed bounds. Unix is a multiuser system that enforces the hardware protection of system resources.

在多用户系统中，每个用户在机器上都有一个私人空间；通常，他拥有一定的磁盘空间配额来存储文件、接收私人邮件消息等。操作系统必须确保用户空间的私有部分仅对其所有者可见。特别是，它必须确保任何用户都不能利用系统应用程序来侵犯其他用户的私人空间。

In a multiuser system, each user has a private space on the machine; typically, he owns some quota of the disk space to store files, receives private mail messages, and so on. The operating system must ensure that the private portion of a user space is visible only to its owner. In particular, it must ensure that no user can exploit a system application for the purpose of violating the private space of another user.

所有用户均由称为用户 ID或UID 的唯一编号进行标识 。通常只允许有限数量的人使用计算机系统。当这些用户之一开始工作会话时，系统会要求输入登录名 和一个密码。如果用户未输入有效的对，系统将拒绝访问。由于密码被假定为秘密的，因此确保了用户的隐私。

All users are identified by a unique number called the User ID, or UID. Usually only a restricted number of persons are allowed to make use of a computer system. When one of these users starts a working session, the system asks for a login name and a password. If the user does not input a valid pair, the system denies access. Because the password is assumed to be secret, the user's privacy is ensured.

为了有选择地与其他用户共享材料，每个用户都是一个或多个用户组的成员 ，由称为 用户组 ID 的唯一编号来标识 。每个文件都与一组相关联。例如，可以设置访问权限，以便拥有该文件的用户具有读写权限，该组具有只读权限，并且拒绝系统上的其他用户访问该文件。

To selectively share material with other users, each user is a member of one or more user groups , which are identified by a unique number called a user group ID . Each file is associated with exactly one group. For example, access can be set so the user owning the file has read and write privileges, the group has read-only privileges, and other users on the system are denied access to the file.

任何类 Unix 操作系统都有一个称为 root或超级用户的特殊用户 。系统管理员必须以root身份登录来处理用户帐户、执行系统备份和程序升级等维护任务。root 用户几乎可以做所有事情，因为操作系统没有对她应用通常的保护机制。特别是，root 用户可以访问系统上的每个文件，并且可以操作每个正在运行的用户程序。

Any Unix-like operating system has a special user called root or superuser . The system administrator must log in as root to handle user accounts, perform maintenance tasks such as system backups and program upgrades, and so on. The root user can do almost everything, because the operating system does not apply the usual protection mechanisms to her. In particular, the root user can access every file on the system and can manipulate every running user program.

所有操作系统都使用一个基本抽象：进程。进程可以定义为“正在执行的程序的实例”，也可以定义为正在运行的程序的“执行上下文”。在传统操作系统中，进程在地址空间中执行单个指令序列；地址空间是允许进程引用的一组内存地址。现代操作系统允许进程具有多个执行流——即在同一地址空间中执行多个指令序列。

All operating systems use one fundamental abstraction: the process. A process can be defined either as "an instance of a program in execution" or as the "execution context" of a running program. In traditional operating systems, a process executes a single sequence of instructions in an address space; the address space is the set of memory addresses that the process is allowed to reference. Modern operating systems allow processes with multiple execution flows — that is, multiple sequences of instructions executed in the same address space.

多用户系统必须强制执行一个执行环境，其中多个进程可以同时活动并争夺系统资源（主要是 CPU）。允许并发活动进程的系统被称为多道程序设计 或多处理 。^{[ * ]}区分程序和进程很重要；多个进程可以同时执行同一个程序，而同一个进程可以顺序执行多个程序。

Multiuser systems must enforce an execution environment in which several processes can be active concurrently and contend for system resources, mainly the CPU. Systems that allow concurrent active processes are said to be multiprogramming or multiprocessing .^[*] It is important to distinguish programs from processes; several processes can execute the same program concurrently, while the same process can execute several programs sequentially.

在单处理器系统上，只有一个进程可以占用 CPU，因此一次只能有一个执行流进行。一般来说，CPU 的数量总是受到限制，因此只有少数进程可以同时进行。称为调度程序的操作系统组件选择可以继续进行的进程。有些操作系统只允许 不可抢占的进程，这意味着只有当进程自愿放弃 CPU 时才会调用调度程序。但多用户系统的进程必须是可 抢占的；操作系统跟踪每个进程占用CPU的时间并定期激活调度程序。

On uniprocessor systems, just one process can hold the CPU, and hence just one execution flow can progress at a time. In general, the number of CPUs is always restricted, and therefore only a few processes can progress at once. An operating system component called the scheduler chooses the process that can progress. Some operating systems allow only nonpreemptable processes, which means that the scheduler is invoked only when a process voluntarily relinquishes the CPU. But processes of a multiuser system must be preemptable; the operating system tracks how long each process holds the CPU and periodically activates the scheduler.

Unix 是一个具有可抢占进程的多处理操作系统。即使没有用户登录并且没有应用程序运行，多个系统进程也会监视外围设备。特别是，有几个进程在系统终端上监听，等待用户登录。当用户输入登录名时，侦听进程会运行一个程序来验证用户密码。如果用户身份得到确认，该进程将创建另一个运行 shell 的进程，在该 shell 中输入命令。当图形显示被激活时，一个进程运行窗口管理器，并且显示器上的每个窗口通常由单独的进程运行。当用户创建图形 shell 时，一个进程运行图形窗口，第二个进程运行用户可以在其中输入命令的 shell。对于每个用户命令，

Unix is a multiprocessing operating system with preemptable processes . Even when no user is logged in and no application is running, several system processes monitor the peripheral devices. In particular, several processes listen at the system terminals waiting for user logins. When a user inputs a login name, the listening process runs a program that validates the user password. If the user identity is acknowledged, the process creates another process that runs a shell into which commands are entered. When a graphical display is activated, one process runs the window manager, and each window on the display is usually run by a separate process. When a user creates a graphics shell, one process runs the graphics windows and a second process runs the shell into which the user can enter the commands. For each user command, the shell process creates another process that executes the corresponding program.

类 Unix 操作系统采用进程/内核模型 。每个进程都有一种错觉，认为它是机器上唯一的进程，并且它具有对操作系统服务的独占访问权。每当进程进行系统调用（即向内核发出请求，请参见第10章）时，硬件会将特权模式从用户模式更改为内核模式，并且进程开始执行具有严格限制目的的内核过程。通过这种方式，操作系统在进程的执行上下文中进行操作，以满足其请求。每当请求完全满足时，内核过程就会强制硬件返回到用户模式，并且进程从系统调用后面的指令继续执行。

Unix-like operating systems adopt a process/kernel model . Each process has the illusion that it's the only process on the machine, and it has exclusive access to the operating system services. Whenever a process makes a system call (i.e., a request to the kernel, see Chapter 10), the hardware changes the privilege mode from User Mode to Kernel Mode, and the process starts the execution of a kernel procedure with a strictly limited purpose. In this way, the operating system acts within the execution context of the process in order to satisfy its request. Whenever the request is fully satisfied, the kernel procedure forces the hardware to return to User Mode and the process continues its execution from the instruction following the system call.

如前所述，大多数 Unix 内核都是整体式的：每个内核层都集成到整个内核程序中，并代表当前进程在内核模式下运行。相比之下， 微内核操作系统需要内核提供非常小的功能集，通常包括一些同步原语、简单的调度程序和进程间通信机制。在微内核之上运行的多个系统进程实现其他操作系统层功能，例如内存分配器、设备驱动程序和系统调用处理程序。

As stated before, most Unix kernels are monolithic: each kernel layer is integrated into the whole kernel program and runs in Kernel Mode on behalf of the current process. In contrast, microkernel operating systems demand a very small set of functions from the kernel, generally including a few synchronization primitives, a simple scheduler, and an interprocess communication mechanism. Several system processes that run on top of the microkernel implement other operating system-layer functions, like memory allocators, device drivers, and system call handlers.

虽然操作系统的学术研究是面向微内核的，这样的操作系统通常比单片操作系统慢，因为在操作系统的不同层之间传递显式消息是有成本的。然而，微内核操作系统可能比单片操作系统具有一些理论上的优势。微内核迫使系统程序员采用模块化方法，因为每个操作系统层都是一个相对独立的程序，必须通过定义良好且干净的软件接口与其他层进行交互。此外，现有的微内核操作系统可以很容易地移植到其他体系结构，因为所有依赖于硬件的组件通常都封装在微内核代码中。最后，

Although academic research on operating systems is oriented toward microkernels , such operating systems are generally slower than monolithic ones, because the explicit message passing between the different layers of the operating system has a cost. However, microkernel operating systems might have some theoretical advantages over monolithic ones. Microkernels force the system programmers to adopt a modularized approach, because each operating system layer is a relatively independent program that must interact with the other layers through well-defined and clean software interfaces. Moreover, an existing microkernel operating system can be easily ported to other architectures fairly easily, because all hardware-dependent components are generally encapsulated in the microkernel code. Finally, microkernel operating systems tend to make better use of random access memory (RAM) than monolithic ones, because system processes that aren't implementing needed functionalities might be swapped out or destroyed.

为了实现微内核的许多理论优势而不引入性能损失，Linux 内核提供了 模块 。模块是一个目标文件，其代码可以在运行时链接到内核（或从内核取消链接）。目标代码通常由一组函数组成，这些函数实现文件系统、设备驱动程序或内核上层的其他功能。与微内核操作系统的外层不同，该模块不作为特定进程运行。相反，它代表当前进程在内核模式下执行，就像任何其他静态链接的内核函数一样。

To achieve many of the theoretical advantages of microkernels without introducing performance penalties, the Linux kernel offers modules . A module is an object file whose code can be linked to (and unlinked from) the kernel at runtime. The object code usually consists of a set of functions that implements a filesystem, a device driver, or other features at the kernel's upper layer. The module, unlike the external layers of microkernel operating systems, does not run as a specific process. Instead, it is executed in Kernel Mode on behalf of the current process, like any other statically linked kernel function.

使用模块的主要优点包括：

The main advantages of using modules include:

Unix 文件是一种结构为字节序列的信息容器；内核不解释文件的内容。许多编程库实现了更高级别的抽象，例如结构化为字段的记录和基于键的记录寻址。然而，这些库中的程序必须依赖于内核提供的系统调用。从用户的角度来看，文件被组织在树形结构的命名空间中，如图1-1所示。

A Unix file is an information container structured as a sequence of bytes; the kernel does not interpret the contents of a file. Many programming libraries implement higher-level abstractions, such as records structured into fields and record addressing based on keys. However, the programs in these libraries must rely on system calls offered by the kernel. From the user's point of view, files are organized in a tree-structured namespace, as shown in Figure 1-1.

图 1-1。目录树的示例

Figure 1-1. An example of a directory tree

树的所有节点（除了叶子）都表示目录名称。目录节点包含有关其下方的文件和目录的信息。文件或目录名由任意 ASCII 字符序列组成，^{[ * ]}（/ 和空字符 \0 除外）。大多数文件系统对文件名的长度都有限制，通常不超过 255 个字符。树的根对应的目录称为根目录。按照约定，其名称是斜杠 ( /)。同一目录中的名称必须不同，但不同目录中可以使用相同的名称。

All the nodes of the tree, except the leaves, denote directory names. A directory node contains information about the files and directories just beneath it. A file or directory name consists of a sequence of arbitrary ASCII characters,^[*] with the exception of / and of the null character \0. Most filesystems place a limit on the length of a filename, typically no more than 255 characters. The directory corresponding to the root of the tree is called the root directory. By convention, its name is a slash (/). Names must be different within the same directory, but the same name may be used in different directories.

Unix 关联当前工作目录 每个进程（参见本章后面的“进程/内核模型”部分）；它属于进程执行上下文，它标识进程当前使用的目录。为了标识特定文件，该进程使用 路径名，该路径名由斜杠与通向该文件的目录名序列交替组成。如果路径名中的第一项是斜杠，则该路径名被称为 绝对路径，因为它的起点是根目录。否则，如果第一项是目录名或文件名，则路径名被称为相对路径，因为它的起点是进程的当前目录。

Unix associates a current working directory with each process (see the section "The Process/Kernel Model" later in this chapter); it belongs to the process execution context, and it identifies the directory currently used by the process. To identify a specific file, the process uses a pathname, which consists of slashes alternating with a sequence of directory names that lead to the file. If the first item in the pathname is a slash, the pathname is said to be absolute, because its starting point is the root directory. Otherwise, if the first item is a directory name or filename, the pathname is said to be relative, because its starting point is the process's current directory.

指定文件名时，符号“.” 和“..”也被使用。它们分别表示当前工作目录及其父目录。如果当前工作目录是根目录，则“.” 和“..”重合。

While specifying filenames, the notations "." and ".." are also used. They denote the current working directory and its parent directory, respectively. If the current working directory is the root directory, "." and ".." coincide.

目录中包含的文件名称为文件 硬链接，或更简单地 称为链接。同一文件可能在同一目录或不同目录中包含多个链接，因此它可能有多个文件名。

A filename included in a directory is called a file hard link, or more simply, a link. The same file may have several links included in the same directory or in different ones, so it may have several filenames.

Unix 命令：

The Unix command:

    $ ln p1 p2

    $ ln p1 p2

用于创建一个新的硬链接，该链接具有p2由 pathname 标识的文件的 路径名p1。

is used to create a new hard link that has the pathname p2 for a file identified by the pathname p1.

硬链接有两个限制：

Hard links have two limitations:

为了克服这些限制，软链接 （也称为符号链接）很久以前就被引入了。符号链接是包含另一个文件的任意路径名的短文件。路径名可以指位于任何文件系统中的任何文件或目录；它甚至可能引用一个不存在的文件。

To overcome these limitations, soft links (also called symbolic links) were introduced a long time ago. Symbolic links are short files that contain an arbitrary pathname of another file. The pathname may refer to any file or directory located in any filesystem; it may even refer to a nonexistent file.

Unix 命令：

The Unix command:

    $ ln -s p1 p2

    $ ln -s p1 p2

创建一个新的软链接，p2其路径名引用路径名p1。执行此命令时，文件系统提取 的目录部分，p2并在该目录中创建一个符号链接类型的新条目，名称由 指示p2。这个新文件包含由 pathname 指示的名称p1。这样，每个对 的引用都p2可以自动转换为对 的引用p1。

creates a new soft link with pathname p2 that refers to pathname p1. When this command is executed, the filesystem extracts the directory part of p2 and creates a new entry in that directory of type symbolic link, with the name indicated by p2. This new file contains the name indicated by pathname p1. This way, each reference to p2 can be translated automatically into a reference to p1.

Unix 文件可能具有以下类型之一：

Unix files may have one of the following types:

前三种文件类型是任何 Unix 文件系统的组成部分。第 18 章详细描述了它们的实现。

The first three file types are constituents of any Unix filesystem. Their implementation is described in detail in Chapter 18.

设备文件与 I/O 设备以及集成到内核中的设备驱动程序相关。例如，当程序访问设备文件时，它直接作用于与该文件关联的 I/O 设备（参见第 13 章）。

Device files are related both to I/O devices, and to device drivers integrated into the kernel. For example, when a program accesses a device file, it acts directly on the I/O device associated with that file (see Chapter 13).

管道和套接字是用于进程间通信的特殊文件（请参阅本章后面的“同步和关键区域”部分；另请参阅第 19 章）。

Pipes and sockets are special files used for interprocess communication (see the section "Synchronization and Critical Regions" later in this chapter; also see Chapter 19).

Unix 对文件的内容和文件的信息进行了明确的区分。除了设备文件和特殊文件系统的文件之外，每个文件都由字节序列组成。该文件不包含任何控制信息，例如其长度或文件结束 (EOF) 分隔符。

Unix makes a clear distinction between the contents of a file and the information about a file. With the exception of device files and files of special filesystems, each file consists of a sequence of bytes. The file does not include any control information, such as its length or an end-of-file (EOF) delimiter.

文件系统处理文件所需的所有信息都包含在称为inode的数据结构中。每个文件都有自己的索引节点，文件系统用它来识别文件。

All information needed by the filesystem to handle a file is included in a data structure called an inode. Each file has its own inode, which the filesystem uses to identify the file.

虽然不同 Unix 系统的文件系统和处理它们的内核函数可能有很大差异，但它们必须始终至少提供 POSIX 标准中指定的以下属性：

While filesystems and the kernel functions handling them can vary widely from one Unix system to another, they must always provide at least the following attributes, which are specified in the POSIX standard:

文件的潜在用户分为三类：

The potential users of a file fall into three classes:

这三个类中的每一个都具有三种类型的访问权限——读、写和 执行。因此，与文件关联的访问权限集由九个不同的二进制标志组成。三个附加标志，称为 suid（设置用户 ID）、 sgid（设置组 ID）和 Sticky，定义文件模式。当应用于可执行文件时，这些标志具有以下含义：

There are three types of access rights -- read, write, and execute — for each of these three classes. Thus, the set of access rights associated with a file consists of nine different binary flags. Three additional flags, called suid (Set User ID), sgid (Set Group ID), and sticky, define the file mode. These flags have the following meanings when applied to executable files:

当进程创建文件时，其所有者 ID 就是该进程的 UID。其所有者用户组ID可以是创建者进程的进程组ID，也可以是父目录的用户组ID，具体取决于sgid父目录的标志值。

When a file is created by a process, its owner ID is the UID of the process. Its owner user group ID can be either the process group ID of the creator process or the user group ID of the parent directory, depending on the value of the sgid flag of the parent directory.

当用户访问常规文件或目录的内容时，他实际上访问了存储在硬件块设备中的一些数据。从这个意义上说，文件系统是硬盘分区物理组织的用户级视图。由于用户模式下的进程无法直接与低级硬件组件交互，因此每个实际的文件操作都必须在内核模式下执行。因此，Unix操作系统定义了几个与文件处理相关的系统调用。

When a user accesses the contents of either a regular file or a directory, he actually accesses some data stored in a hardware block device. In this sense, a filesystem is a user-level view of the physical organization of a hard disk partition. Because a process in User Mode cannot directly interact with the low-level hardware components, each actual file operation must be performed in Kernel Mode. Therefore, the Unix operating system defines several system calls related to file handling.

所有 Unix 内核都非常注重硬件块设备的有效处理，以实现良好的整体系统性能。在接下来的章节中，我们将描述与 Linux 中的文件处理相关的主题，特别是内核如何对与文件相关的系统调用做出反应。要理解这些描述，您需要了解主要文件处理系统调用的使用方式；这些将在下一节中描述。

All Unix kernels devote great attention to the efficient handling of hardware block devices to achieve good overall system performance. In the chapters that follow, we will describe topics related to file handling in Linux and specifically how the kernel reacts to file-related system calls. To understand those descriptions, you will need to know how the main file-handling system calls are used; these are described in the next section.

    fd = open(路径、标志、模式)

    fd = open(path, flag, mode)

    newoffset = lseek(fd, 偏移量, 来源);

    newoffset = lseek(fd, offset, whence);

nread = 读取(fd, buf, 计数);

nread = read(fd, buf, count);

    res = 关闭(fd);

    res = close(fd);

    res = 重命名（旧路径，新路径）；

    res = rename(oldpath, newpath);

    res = 取消链接(路径名);

    res = unlink(pathname);

正如已经提到的，CPU 可以运行在任一用户模式或内核模式。实际上，一些CPU可以有两个以上的执行状态。例如，80 × 86 微处理器有四种不同的执行状态。但所有标准 Unix 内核仅使用内核模式和用户模式。

As already mentioned, a CPU can run in either User Mode or Kernel Mode . Actually, some CPUs can have more than two execution states. For instance, the 80 × 86 microprocessors have four different execution states. But all standard Unix kernels use only Kernel Mode and User Mode.

当程序在用户态执行时，它不能直接访问内核数据结构或内核程序。然而，当应用程序在内核模式下执行时，这些限制就不再适用。每个 CPU 型号都提供特殊指令来从用户模式切换到内核模式，反之亦然。程序通常在用户态下执行，只有在请求内核提供的服务时才切换到内核态。当内核满足了程序的请求后，它会将程序放回用户模式。

When a program is executed in User Mode, it cannot directly access the kernel data structures or the kernel programs. When an application executes in Kernel Mode, however, these restrictions no longer apply. Each CPU model provides special instructions to switch from User Mode to Kernel Mode and vice versa. A program usually executes in User Mode and switches to Kernel Mode only when requesting a service provided by the kernel. When the kernel has satisfied the program's request, it puts the program back in User Mode.

进程是动态实体，通常在系统中具有有限的生命周期。创建、消除和同步现有流程的任务被委托给内核中的一组例程。

Processes are dynamic entities that usually have a limited life span within the system. The task of creating, eliminating, and synchronizing the existing processes is delegated to a group of routines in the kernel.

内核本身不是一个进程，而是一个进程管理器。进程/内核模型假设需要内核服务的进程使用称为系统调用的特定编程结构 。每个系统调用都会设置一组标识进程请求的参数，然后执行与硬件相关的 CPU 指令以从用户模式切换到内核模式。

The kernel itself is not a process but a process manager. The process/kernel model assumes that processes that require a kernel service use specific programming constructs called system calls . Each system call sets up the group of parameters that identifies the process request and then executes the hardware-dependent CPU instruction to switch from User Mode to Kernel Mode.

除了用户进程之外，Unix 系统还包括一些称为内核线程的特权进程 具有以下特点：

Besides user processes, Unix systems include a few privileged processes called kernel threads with the following characteristics:

在单处理器系统上，一次只有一个进程运行，并且它可以在用户模式或内核模式下运行。如果它在内核模式下运行，则处理器正在执行某些内核例程。图 1-2说明了用户模式和内核模式之间转换的示例。用户模式下的进程 1 发出系统调用，之后该进程切换到内核模式，并为系统调用提供服务。然后，进程 1 在用户模式下恢复执行，直到发生定时器中断，并且调度程序在内核模式下被激活。发生进程切换，进程 2 开始在用户模式下执行，直到硬件设备发出中断。作为中断的结果，进程 2 切换到内核模式并处理中断。

On a uniprocessor system, only one process is running at a time, and it may run either in User or in Kernel Mode. If it runs in Kernel Mode, the processor is executing some kernel routine. Figure 1-2 illustrates examples of transitions between User and Kernel Mode. Process 1 in User Mode issues a system call, after which the process switches to Kernel Mode, and the system call is serviced. Process 1 then resumes execution in User Mode until a timer interrupt occurs, and the scheduler is activated in Kernel Mode. A process switch takes place, and Process 2 starts its execution in User Mode until a hardware device raises an interrupt. As a consequence of the interrupt, Process 2 switches to Kernel Mode and services the interrupt.

图 1-2。用户模式和内核模式之间的转换

Figure 1-2. Transitions between User and Kernel Mode

Unix 内核的作用远不止处理系统调用；事实上，内核例程可以通过多种方式激活：

Unix kernels do much more than handle system calls; in fact, kernel routines can be activated in several ways:

为了让内核管理进程，每个进程都由一个进程描述符表示，其中包含有关进程当前状态的信息。

To let the kernel manage processes, each process is represented by a process descriptor that includes information about the current state of the process.

当内核停止进程的执行时，它将几个处理器寄存器的当前内容保存在进程描述符中。这些包括：

When the kernel stops the execution of a process, it saves the current contents of several processor registers in the process descriptor. These include:

当内核决定恢复执行进程时，它会使用正确的进程描述符字段来加载 CPU 寄存器。由于程序计数器的存储值指向最后执行的指令之后的指令，因此进程会从停止的位置恢复执行。

When the kernel decides to resume executing a process, it uses the proper process descriptor fields to load the CPU registers. Because the stored value of the program counter points to the instruction following the last instruction executed, the process resumes execution at the point where it was stopped.

当进程不在 CPU 上执行时，它正在等待某个事件。Unix内核区分了很多等待状态，这些状态通常是通过进程描述符的队列来实现的; 每个（可能为空）队列对应于等待特定事件的进程集。

When a process is not executing on the CPU, it is waiting for some event. Unix kernels distinguish many wait states, which are usually implemented by queues of process descriptors ; each (possibly empty) queue corresponds to the set of processes waiting for a specific event.

所有 Unix 内核都是可重入的。这意味着多个进程可能同时在内核模式下执行。当然，在单处理器系统上，只有一个进程可以进行，但许多进程在等待 CPU 或完成某些 I/O 操作时可能会在内核模式下被阻塞。例如，在代表进程向磁盘发出读取操作后，内核让磁盘控制器处理它并恢复执行其他进程。当设备满足读取时，中断会通知内核，以便之前的进程可以恢复执行。

All Unix kernels are reentrant. This means that several processes may be executing in Kernel Mode at the same time. Of course, on uniprocessor systems, only one process can progress, but many can be blocked in Kernel Mode when waiting for the CPU or the completion of some I/O operation. For instance, after issuing a read to a disk on behalf of a process, the kernel lets the disk controller handle it and resumes executing other processes. An interrupt notifies the kernel when the device has satisfied the read, so the former process can resume the execution.

提供可重入性的一种方法是编写函数，使其仅修改局部变量而不改变全局数据结构。此类函数称为可重入函数 。但可重入内核不仅限于此类可重入函数（尽管这是某些实时内核的实现方式）。相反，内核可以包含不可重入函数并使用锁定机制来确保一次只有一个进程可以执行不可重入函数。

One way to provide reentrancy is to write functions so that they modify only local variables and do not alter global data structures. Such functions are called reentrant functions . But a reentrant kernel is not limited only to such reentrant functions (although that is how some real-time kernels are implemented). Instead, the kernel can include nonreentrant functions and use locking mechanisms to ensure that only one process can execute a nonreentrant function at a time.

如果发生硬件中断，可重入内核能够挂起当前正在运行的进程，即使该进程处于内核模式也是如此。此功能非常重要，因为它提高了发出中断的设备控制器的吞吐量。一旦设备发出中断，它就会等待，直到 CPU 确认它。如果内核能够快速响应，设备控制器将能够在 CPU 处理中断的同时执行其他任务。

If a hardware interrupt occurs, a reentrant kernel is able to suspend the current running process even if that process is in Kernel Mode. This capability is very important, because it improves the throughput of the device controllers that issue interrupts. Once a device has issued an interrupt, it waits until the CPU acknowledges it. If the kernel is able to answer quickly, the device controller will be able to perform other tasks while the CPU handles the interrupt.

现在让我们看看内核重入及其对内核组织的影响。内核控制路径 表示内核为处理系统调用、异常或中断而执行的指令序列。

Now let's look at kernel reentrancy and its impact on the organization of the kernel. A kernel control path denotes the sequence of instructions executed by the kernel to handle a system call, an exception, or an interrupt.

在最简单的情况下，CPU从第一条指令到最后一条指令顺序执行内核控制路径。但是，当发生以下事件之一时，CPU 会交错内核控制路径:

In the simplest case, the CPU executes a kernel control path sequentially from the first instruction to the last. When one of the following events occurs, however, the CPU interleaves the kernel control paths :

图 1-3 说明了非交错和交错内核控制路径的几个示例。考虑三种不同的 CPU 状态：

Figure 1-3 illustrates a few examples of noninterleaved and interleaved kernel control paths. Three different CPU states are considered:

每个进程都在其私有地址空间中运行。在用户模式下运行的进程指的是私有堆栈、数据和代码区域。当在内核模式下运行时，进程寻址内核数据和代码区域并使用另一个私有堆栈。

Each process runs in its private address space. A process running in User Mode refers to private stack, data, and code areas. When running in Kernel Mode, the process addresses the kernel data and code areas and uses another private stack.

由于内核是可重入的，因此可以依次执行多个内核控制路径（每个路径与不同的进程相关）。在这种情况下，每个内核控制路径都引用其自己的私有内核堆栈。

Because the kernel is reentrant, several kernel control paths—each related to a different process—may be executed in turn. In this case, each kernel control path refers to its own private kernel stack.

虽然每个进程似乎都可以访问私有地址空间，但有时部分地址空间会在进程之间共享。在某些情况下，进程明确请求这种共享；在其他情况下，它是由内核自动完成的，以减少内存使用。

While it appears to each process that it has access to a private address space, there are times when part of the address space is shared among processes. In some cases, this sharing is explicitly requested by processes; in others, it is done automatically by the kernel to reduce memory usage.

如果多个用户同时需要同一个程序（例如编辑器），则该程序仅加载到内存中一次，并且其指令可以由所有需要它的用户共享。当然，它的数据不能共享，因为每个用户都会有单独的数据。这种共享地址空间是由内核自动完成的，以节省内存。

If the same program, say an editor, is needed simultaneously by several users, the program is loaded into memory only once, and its instructions can be shared by all of the users who need it. Its data, of course, must not be shared, because each user will have separate data. This kind of shared address space is done automatically by the kernel to save memory.

进程还可以使用 System V 中引入的“共享内存”技术来共享部分地址空间，作为一种进程间通信并受Linux支持。

Processes also can share parts of their address space as a kind of interprocess communication, using the "shared memory" technique introduced in System V and supported by Linux.

最后，Linux 支持mmap( ) 系统调用，它允许将文件的一部分或存储在块设备上的信息映射到进程地址空间的一部分。内存映射可以为传输数据提供正常读写的替代方案。如果同一个文件被多个进程共享，则其内存映射包含在共享它的每个进程的地址空间中。

Finally, Linux supports the mmap( ) system call, which allows part of a file or the information stored on a block device to be mapped into a part of a process address space. Memory mapping can provide an alternative to normal reads and writes for transferring data. If the same file is shared by several processes, its memory mapping is included in the address space of each of the processes that share it.

实现可重入内核需要使用同步。如果内核控制路径在作用于内核数据结构时被挂起，则不应允许其他内核控制路径作用于同一数据结构，除非它已重置为一致状态。否则，两个控制路径的交互可能会破坏存储的信息。

Implementing a reentrant kernel requires the use of synchronization . If a kernel control path is suspended while acting on a kernel data structure, no other kernel control path should be allowed to act on the same data structure unless it has been reset to a consistent state. Otherwise, the interaction of the two control paths could corrupt the stored information.

例如，假设全局变量 V 包含某些系统资源的可用项数。第一个内核控制路径 A 读取变量并确定只有一个可用项。此时，另一个内核控制路径 B 被激活并读取相同的变量，该变量仍然包含值 1。因此，B 减少 V 并开始使用资源项。然后A继续执行；因为它已经读取了 V 的值，所以它假设它可以减少 V 并获取 B 已经使用的资源项。最终结果是，V 包含 -1，并且两个内核控制路径使用相同的资源项，可能会产生灾难性的影响。

For example, suppose a global variable V contains the number of available items of some system resource. The first kernel control path, A, reads the variable and determines that there is just one available item. At this point, another kernel control path, B, is activated and reads the same variable, which still contains the value 1. Thus, B decreases V and starts using the resource item. Then A resumes the execution; because it has already read the value of V, it assumes that it can decrease V and take the resource item, which B already uses. As a final result, V contains -1, and two kernel control paths use the same resource item with potentially disastrous effects.

当计算结果取决于两个或多个进程的调度方式时，代码是不正确的。我们说存在 竞争条件。

When the outcome of a computation depends on how two or more processes are scheduled, the code is incorrect. We say that there is a race condition.

一般来说，通过使用 原子操作来确保对全局变量的安全访问 。在前面的示例中，如果两个控制路径通过单个不可中断操作读取并减小 V，则不可能出现数据损坏。然而，内核包含许多无法通过单个操作访问的数据结构。例如，通常不可能通过单个操作从链表中删除元素，因为内核需要同时访问至少两个指针。在另一个进程可以进入它之前，每个启动它的进程应该完成的任何代码部分称为临界区域。^{[ * ]}

In general, safe access to a global variable is ensured by using atomic operations . In the previous example, data corruption is not possible if the two control paths read and decrease V with a single, noninterruptible operation. However, kernels contain many data structures that cannot be accessed with a single operation. For example, it usually isn't possible to remove an element from a linked list with a single operation, because the kernel needs to access at least two pointers at once. Any section of code that should be finished by each process that begins it before another process can enter it is called a critical region.^[*]

这些问题不仅发生在内核控制路径之间，而且还发生在共享公共数据的进程之间。已采用多种同步技术。以下部分重点介绍如何同步内核控制路径。

These problems occur not only among kernel control paths but also among processes sharing common data. Several synchronization techniques have been adopted. The following section concentrates on how to synchronize kernel control paths.

Unix信号 提供一种向进程通知系统事件的机制。每个事件都有自己的信号编号，通常由符号常量（例如 ）来引用SIGTERM。系统事件有两种：

Unix signals provide a mechanism for notifying processes of system events. Each event has its own signal number, which is usually referred to by a symbolic constant such as SIGTERM. There are two kinds of system events:

POSIX 标准定义了大约 20 种不同的信号，其中 2 种是用户可定义的，可用作用户模式下进程之间通信和同步的原始机制。一般来说，进程可以通过两种可能的方式对信号传递做出反应：

The POSIX standard defines about 20 different signals, 2 of which are user-definable and may be used as a primitive mechanism for communication and synchronization among processes in User Mode. In general, a process may react to a signal delivery in two possible ways:

如果进程未指定这些替代方案之一，则内核将执行取决于信号编号的默认操作。五种可能的默认操作是：

If the process does not specify one of these alternatives, the kernel performs a default action that depends on the signal number. The five possible default actions are:

内核信号处理相当复杂，因为 POSIX 语义允许进程暂时阻止信号。而且， SIGKILL和SIGSTOP信号不能被进程直接处理或忽略。

Kernel signal handling is rather elaborate, because the POSIX semantics allows processes to temporarily block signals. Moreover, the SIGKILL and SIGSTOP signals cannot be directly handled by the process or ignored.

AT&T 的 Unix 系统 V介绍了用户模式下进程间的其他类型的进程间通信，这些通信已被许多 Unix 内核采用：信号量 、消息队列 ，和共享内存 。它们统称为System V IPC。

AT&T's Unix System V introduced other kinds of interprocess communication among processes in User Mode, which have been adopted by many Unix kernels: semaphores , message queues , and shared memory . They are collectively known as System V IPC.

内核将这些结构实现为IPC 资源。进程通过调用获取资源 shmget( ) ,semget( ) ， 或者msgget( ) 系统调用。就像文件一样，IPC 资源是持久性的：它们必须由创建者进程、当前所有者或超级用户进程显式释放。

The kernel implements these constructs as IPC resources. A process acquires a resource by invoking a shmget( ) , semget( ) , or msgget( ) system call. Just like files, IPC resources are persistent: they must be explicitly deallocated by the creator process, by the current owner, or by a superuser process.

信号量与本章前面的“同步和关键区域”部分中描述的信号量类似，只是它们是为用户模式下的进程保留的。消息队列允许进程通过使用以下方式交换消息msgsnd( ) 和msgrcv( ) 系统调用，分别将消息插入到特定的消息队列中并从中提取消息。

Semaphores are similar to those described in the section "Synchronization and Critical Regions," earlier in this chapter, except that they are reserved for processes in User Mode. Message queues allow processes to exchange messages by using the msgsnd( ) and msgrcv( ) system calls, which insert a message into a specific message queue and extract a message from it, respectively.

POSIX标准（IEEE Std 1003.1-2001）定义了一种基于消息队列的IPC机制，通常称为 POSIX消息队列 。它们类似于 System V IPC 的消息队列，但它们具有更简单的基于文件的应用程序接口。

The POSIX standard (IEEE Std 1003.1-2001) defines an IPC mechanism based on message queues, which is usually known as POSIX message queues . They are similar to the System V IPC's message queues, but they have a much simpler file-based interface to the applications.

共享内存为进程交换和共享数据提供了最快的方式。进程首先发出shmget( )系统调用来创建具有所需大小的新共享内存。进程获得IPC资源标识符后，调用shmat( ) 系统调用，返回进程地址空间中新区域的起始地址。当进程希望从其地址空间分离共享内存时，它会调用 shmdt( ) 系统调用。共享内存的实现取决于内核如何实现进程地址空间。

Shared memory provides the fastest way for processes to exchange and share data. A process starts by issuing a shmget( ) system call to create a new shared memory having a required size. After obtaining the IPC resource identifier, the process invokes the shmat( ) system call, which returns the starting address of the new region within the process address space. When the process wishes to detach the shared memory from its address space, it invokes the shmdt( ) system call. The implementation of shared memory depends on how the kernel implements process address spaces.

Unix 对进程和它正在执行的程序进行了明确的区分。为此，fork( ) 和_exit( ) 系统调用分别用于创建新进程和终止它，而类似exec( )系统调用则用于加载新程序。执行这样的系统调用后，进程将使用包含加载程序的全新地址空间恢复执行。

Unix makes a neat distinction between the process and the program it is executing. To that end, the fork( ) and _exit( ) system calls are used respectively to create a new process and to terminate it, while an exec( )-like system call is invoked to load a new program. After such a system call is executed, the process resumes execution with a brand new address space containing the loaded program.

调用 a 的进程fork( )是父进程，而新进程是其子进程。父进程和子进程可以找到彼此，因为描述每个进程的数据结构包括指向其直接父进程的指针和指向其所有直接子进程的指针。

The process that invokes a fork( ) is the parent, while the new process is its child. Parents and children can find one another because the data structure describing each process includes a pointer to its immediate parent and pointers to all its immediate children.

一个简单的实现fork( )将需要复制父级的数据和父级的代码，并将副本分配给子级。这将是相当耗时的。当前可以依赖于硬件分页单元的内核遵循写入时复制方法，该方法将页面复制推迟到最后一刻（即，直到需要父级或子级写入页面为止）。我们将在第 9 章的“写入时复制”部分描述 Linux 如何实现该技术。

A naive implementation of the fork( ) would require both the parent's data and the parent's code to be duplicated and the copies assigned to the child. This would be quite time consuming. Current kernels that can rely on hardware paging units follow the Copy-On-Write approach, which defers page duplication until the last moment (i.e., until the parent or the child is required to write into a page). We shall describe how Linux implements this technique in the section "Copy On Write" in Chapter 9.

系统_exit( )调用终止一个进程。内核通过释放进程拥有的资源并向父进程发送信号来处理此系统调用 SIGCHLD，默认情况下会忽略该信号。

The _exit( ) system call terminates a process. The kernel handles this system call by releasing the resources owned by the process and sending the parent process a SIGCHLD signal, which is ignored by default.

    $ ls | 排序| 更多的

    $ ls | sort | more

内存管理是 Unix 内核中迄今为止最复杂的活动。本书超过三分之一的内容专门用于描述 Linux 如何处理内存管理。本节说明与内存管理相关的一些主要问题。

Memory management is by far the most complex activity in a Unix kernel. More than a third of this book is dedicated just to describing how Linux handles memory management. This section illustrates some of the main issues related to memory management.

内核通过 设备驱动程序与I/O设备交互 。设备驱动程序包含在内核中，由控制一个或多个设备（例如硬盘、键盘、鼠标、监视器、网络接口和连接到 SCSI 总线的设备）的数据结构和函数组成。每个驱动程序通过特定的接口与内核的其余部分（甚至与其他驱动程序）交互。这种方法有以下优点：

The kernel interacts with I/O devices by means of device drivers . Device drivers are included in the kernel and consist of data structures and functions that control one or more devices, such as hard disks, keyboards, mouses, monitors, network interfaces, and devices connected to an SCSI bus. Each driver interacts with the remaining part of the kernel (even with other drivers) through a specific interface. This approach has the following advantages:

图 1-4 说明了设备驱动程序如何与内核的其余部分以及进程进行交互。

Figure 1-4 illustrates how device drivers interface with the rest of the kernel and with the processes.

图 1-4。设备驱动接口

Figure 1-4. Device driver interface

一些用户程序（P）希望在硬件设备上运行。它们使用通常的文件相关系统调用和通常在/dev目录中找到的设备文件向内核发出请求。实际上，设备文件是设备驱动程序接口中用户可见的部分。每个设备文件引用一个特定的设备驱动程序，该驱动程序由内核调用以在硬件组件上执行请求的操作。

Some user programs (P) wish to operate on hardware devices. They make requests to the kernel using the usual file-related system calls and the device files normally found in the /dev directory. Actually, the device files are the user-visible portion of the device driver interface. Each device file refers to a specific device driver, which is invoked by the kernel to perform the requested operation on the hardware component.

在 Unix 推出时，图形终端并不常见且昂贵，因此 Unix 内核只直接处理字母数字终端。当图形终端变得普遍时，临时应用程序（例如 X Window 系统）引入了作为标准进程运行并直接访问图形接口和 RAM 视频区域的 I/O 端口。最近的一些 Unix 内核，例如 Linux 2.6，为图形卡的帧缓冲区提供了抽象，并允许应用程序软件访问它们，而无需了解有关图形接口的 I/O 端口的任何信息（请参阅“帧缓冲区的级别”部分）内核支持”，第13 章。）

At the time Unix was introduced, graphical terminals were uncommon and expensive, so only alphanumeric terminals were handled directly by Unix kernels. When graphical terminals became widespread, ad hoc applications such as the X Window System were introduced that ran as standard processes and accessed the I/O ports of the graphics interface and the RAM video area directly. Some recent Unix kernels, such as Linux 2.6, provide an abstraction for the frame buffer of the graphic card and allow application software to access them without needing to know anything about the I/O ports of the graphics interface (see the section "Levels of Kernel Support" in Chapter 13.)

逻辑地址由两部分组成：段标识符和指定段内相对地址的偏移量。段标识符是一个称为段选择器的 16 位字段（见图2-2），而偏移量是一个 32 位字段。我们将在本章后面的“快速访问段描述符”部分中描述段选择器的字段。

A logical address consists of two parts: a segment identifier and an offset that specifies the relative address within the segment. The segment identifier is a 16-bit field called the Segment Selector (see Figure 2-2), while the offset is a 32-bit field. We'll describe the fields of Segment Selectors in the section "Fast Access to Segment Descriptors" later in this chapter.

图 2-2。段选择器格式

Figure 2-2. Segment Selector format

为了方便检索段选择器很快，处理器提供分段寄存器 其唯一目的是持有段选择器；这些寄存器称为cs、ss、ds、 es、fs和gs。尽管只有六个，但程序可以通过将其内容保存在内存中然后在以后恢复来将相同的分段寄存器用于不同的目的。

To make it easy to retrieve segment selectors quickly, the processor provides segmentation registers whose only purpose is to hold Segment Selectors; these registers are called cs, ss, ds, es, fs, and gs. Although there are only six of them, a program can reuse the same segmentation register for different purposes by saving its content in memory and then restoring it later.

六个分段寄存器中的三个具有特定用途：

Three of the six segmentation registers have specific purposes:

其余三个分段寄存器是通用的，可以引用任意数据段。

The remaining three segmentation registers are general purpose and may refer to arbitrary data segments.

该cs寄存器还有另一个重要功能：它包括一个 2 位字段，用于指定 CPU 的当前特权级别 (CPL)。值 0 表示最高权限级别，而值 3 表示最低权限级别。Linux仅使用0级和3级，分别称为内核模式和用户模式。

The cs register has another important function: it includes a 2-bit field that specifies the Current Privilege Level (CPL) of the CPU. The value 0 denotes the highest privilege level, while the value 3 denotes the lowest one. Linux uses only levels 0 and 3, which are respectively called Kernel Mode and User Mode.

每个段由描述段特征的8 字节段描述符表示 。段描述符存储在 全局描述符表（GDT ）或本地描述符表（LDT）。

Each segment is represented by an 8-byte Segment Descriptor that describes the segment characteristics. Segment Descriptors are stored either in the Global Descriptor Table (GDT ) or in the Local Descriptor Table(LDT).

通常只定义一个GDT，而每个进程如果需要创建除GDT中存储的段之外的其他段，则允许有自己的LDT。主存中GDT的地址和大小包含在gdtr 控制寄存器，当前使用的LDT的地址和大小包含在ldtr 控制寄存器。

Usually only one GDT is defined, while each process is permitted to have its own LDT if it needs to create additional segments besides those stored in the GDT. The address and size of the GDT in main memory are contained in the gdtr control register, while the address and size of the currently used LDT are contained in the ldtr control register.

图2-3 说明了段描述符的格式；各个字段的含义如表2-1所示。

Figure 2-3 illustrates the format of a Segment Descriptor; the meaning of the various fields is explained in Table 2-1.

段有多种类型，因此段描述符也有多种类型。下面的列表显示了 Linux 中广泛使用的类型。

There are several types of segments, and thus several types of Segment Descriptors. The following list shows the types that are widely used in Linux.

我们记得逻辑地址由 16 位段选择器和 32 位偏移量组成，并且分段寄存器仅存储段选择器。

We recall that logical addresses consist of a 16-bit Segment Selector and a 32-bit Offset, and that segmentation registers store only the Segment Selector.

为了加速逻辑地址到线性地址的转换，80 × 86 处理器为六个可编程分段寄存器中的每一个提供了一个额外的不可编程寄存器，即程序员无法设置的寄存器。每个不可编程寄存器都包含由相应分段寄存器中包含的段选择器指定的 8 字节段描述符（在上一节中描述）。每次将段选择器加载到段寄存器中时，相应的段描述符就会从内存加载到匹配的不可编程 CPU 寄存器中。从那时起，可以在不访问主存中存储的 GDT 或 LDT 的情况下执行引用该段的逻辑地址的转换；处理器只能直接引用包含段描述符的CPU寄存器。仅当分段寄存器的内容发生更改时才需要访问 GDT 或 LDT（请参见图 2-4 )。

To speed up the translation of logical addresses into linear addresses, the 80 × 86 processor provides an additional nonprogrammable register—that is, a register that cannot be set by a programmer—for each of the six programmable segmentation registers. Each nonprogrammable register contains the 8-byte Segment Descriptor (described in the previous section) specified by the Segment Selector contained in the corresponding segmentation register. Every time a Segment Selector is loaded in a segmentation register, the corresponding Segment Descriptor is loaded from memory into the matching nonprogrammable CPU register. From then on, translations of logical addresses referring to that segment can be performed without accessing the GDT or LDT stored in main memory; the processor can refer only directly to the CPU register containing the Segment Descriptor. Accesses to the GDT or LDT are necessary only when the contents of the segmentation registers change (see Figure 2-4).

图 2-4。段选择器和段描述符

Figure 2-4. Segment Selector and Segment Descriptor

任何段选择器都包含表 2-2 中描述的三个字段。

Any Segment Selector includes three fields that are described in Table 2-2.

因为段描述符有 8 个字节长，所以它在 GDT 或 LDT 中的相对地址是通过将段选择器的 13 位索引字段乘以 8 得到的。例如，如果 GDT 位于（寄存器中存储的值0x00020000）gdtr)，段选择器指定的索引为2，则对应的段描述符的地址为0x00020000+ (2× 8)，或0x00020010。

Because a Segment Descriptor is 8 bytes long, its relative address inside the GDT or the LDT is obtained by multiplying the 13-bit index field of the Segment Selector by 8. For instance, if the GDT is at 0x00020000 (the value stored in the gdtr register) and the index specified by the Segment Selector is 2, the address of the corresponding Segment Descriptor is 0x00020000 + (2 × 8), or 0x00020010.

GDT 的第一个条目始终设置为 0。这确保了具有空段选择器的逻辑地址将被视为无效，从而导致处理器异常。GDT 中可存储的段描述符的最大数量为 8,191（即 2 ¹³ -1）。

The first entry of the GDT is always set to 0. This ensures that logical addresses with a null Segment Selector will be considered invalid, thus causing a processor exception. The maximum number of Segment Descriptors that can be stored in the GDT is 8,191 (i.e., 2¹³-1).

图2-5详细显示了逻辑地址如何转换为相应的线性地址。分割单元执行以下操作：

Figure 2-5 shows in detail how a logical address is translated into a corresponding linear address. The segmentation unit performs the following operations:

请注意，由于与分段寄存器关联的不可编程寄存器，仅当分段寄存器已更改时才需要执行前两个操作。

Notice that, thanks to the nonprogrammable registers associated with the segmentation registers, the first two operations need to be performed only when a segmentation register has been changed.

在单处理器系统中，只有一个 GDT，而在多处理器系统中，系统中的每个 CPU 都有一个 GDT。所有GDT都存储在cpu_gdt_table数组中，而GDT的地址和大小（初始化寄存器时使用gdtr）也存储在cpu_gdt_descr数组中。如果你查看源代码索引，你可以看到这些符号是在文件arch/i386/kernel/head.S中定义的 。本书中的每个宏、函数和其他符号都列在源代码索引中，因此您可以在源代码中快速找到它们。

In uniprocessor systems there is only one GDT, while in multiprocessor systems there is one GDT for every CPU in the system. All GDTs are stored in the cpu_gdt_table array, while the addresses and sizes of the GDTs (used when initializing the gdtr registers) are stored in the cpu_gdt_descr array. If you look in the Source Code Index, you can see that these symbols are defined in the file arch/i386/kernel/head.S . Every macro, function, and other symbol in this book is listed in the Source Code Index, so you can quickly find it in the source code.

GDT 的布局如图 2-6所示。每个 GDT 包括 18 个段描述符和 14 个空、未使用或保留的条目。未使用的条目是有意插入的，以便通常一起访问的段描述符保留在硬件缓存的同一 32 字节行中（请参阅本章后面的“硬件缓存”部分）。

The layout of the GDTs is shown schematically in Figure 2-6. Each GDT includes 18 segment descriptors and 14 null, unused, or reserved entries. Unused entries are inserted on purpose so that Segment Descriptors usually accessed together are kept in the same 32-byte line of the hardware cache (see the section "Hardware Cache" later in this chapter).

每个GDT中包含的18个段描述符指向以下段：

The 18 segment descriptors included in each GDT point to the following segments:

如前所述，系统中的每个处理器都有一个 GDT 副本。除少数情况外，GDT 的所有副本都存储相同的条目。首先，每个处理器都有自己的TSS段，因此对应的GDT的条目不同。此外，GDT 中的一些条目可能取决于 CPU 正在执行的进程（LDT 和 TLS 段描述符）。最后，在某些情况下，处理器可能会临时修改其 GDT 副本中的条目；例如，当调用 APM 的 BIOS 过程时，就会发生这种情况。

As stated earlier, there is a copy of the GDT for each processor in the system. All copies of the GDT store identical entries, except for a few cases. First, each processor has its own TSS segment, thus the corresponding GDT's entries differ. Moreover, a few entries in the GDT may depend on the process that the CPU is executing (LDT and TLS Segment Descriptors). Finally, in some cases a processor may temporarily modify an entry in its copy of the GDT; this happens, for instance, when invoking an APM's BIOS procedure.

大多数Linux用户模式应用程序不使用本地描述符表，因此内核定义了一个由大多数进程共享的默认LDT。默认的本地描述符表存储在default_ldt数组中。它包括五个条目，但内核只有效使用其中两个：iBCS 可执行文件的调用门和 Solaris 的调用门/x86 可执行文件（请参阅第 20 章中的“执行域” 部分）。调用门是80×86微处理器提供的一种机制，用于在调用预定义函数时改变CPU的特权级别；由于我们不会进一步讨论它们，因此您应该查阅英特尔文档以了解更多详细信息。

Most Linux User Mode applications do not make use of a Local Descriptor Table, thus the kernel defines a default LDT to be shared by most processes. The default Local Descriptor Table is stored in the default_ldt array. It includes five entries, but only two of them are effectively used by the kernel: a call gate for iBCS executables, and a call gate for Solaris /x86 executables (see the section "Execution Domains" in Chapter 20). Call gates are a mechanism provided by 80 × 86 microprocessors to change the privilege level of the CPU while invoking a predefined function; as we won't discuss them further, you should consult the Intel documentation for more details.

然而，在某些情况下，进程可能需要设置自己的 LDT。事实证明，这对于执行面向段的 Microsoft Windows 的应用程序（例如 Wine）非常有用应用程序。这modify_ldt( ) 系统调用允许进程执行此操作。

In some cases, however, processes may require to set up their own LDT. This turns out to be useful to applications (such as Wine) that execute segment-oriented Microsoft Windows applications. The modify_ldt( ) system call allows a process to do this.

创建的任何自定义 LDTmodify_ldt( )也需要其自己的段。当处理器开始执行具有自定义 LDT 的进程时，GDT 的 CPU 特定副本中的 LDT 条目会相应更改。

Any custom LDT created by modify_ldt( ) also requires its own segment. When a processor starts executing a process having a custom LDT, the LDT entry in the CPU-specific copy of the GDT is changed accordingly.

用户模式应用程序还可以通过以下方式分配新段modify_ldt( )：然而，内核从不使用这些段，并且不必跟踪相应的段描述符，因为它们包含在进程的自定义 LDT 中。

User Mode applications also may allocate new segments by means of modify_ldt( ); the kernel, however, never makes use of these segments, and it does not have to keep track of the corresponding Segment Descriptors, because they are included in the custom LDT of the process.

从 80386 开始，Intel 处理器的分页单元处理 4 KB 页面。

Starting with the 80386, the paging unit of Intel processors handles 4 KB pages.

线性地址的 32 位分为三个字段：

The 32 bits of a linear address are divided into three fields:

线性地址的转换分两步完成，每一步都基于一种类型的转换表。第一个转换表称为页目录，第二个称为页表。^{[ * ]}

The translation of linear addresses is accomplished in two steps, each based on a type of translation table. The first translation table is called the Page Directory, and the second is called the Page Table.^[*]

这个两级的目的方案的目的是减少每个进程页表所需的 RAM 量。如果使用简单的一级页表，则需要多达 220 个条目（即，每个条目 4 字节，4 MB RAM）来表示每个进程的页表（如果该进程使用了​​完整的 4 GB线性地址空间），即使进程不使用该范围内的所有地址。两级方案仅需要进程实际使用的虚拟内存区域的页表，从而减少了内存。

The aim of this two-level scheme is to reduce the amount of RAM required for per-process Page Tables. If a simple one-level Page Table was used, then it would require up to 220 entries (i.e., at 4 bytes per entry, 4 MB of RAM) to represent the Page Table for each process (if the process used a full 4 GB linear address space), even though a process does not use all addresses in that range. The two-level scheme reduces the memory by requiring Page Tables only for those virtual memory regions actually used by a process.

每个活动进程都必须分配有一个页目录。然而，没有必要一次性为一个进程的所有页表分配RAM；仅当进程有效需要时才为页表分配 RAM 会更有效。

Each active process must have a Page Directory assigned to it. However, there is no need to allocate RAM for all Page Tables of a process at once; it is more efficient to allocate RAM for a Page Table only when the process effectively needs it.

正在使用的页目录的物理地址存储在名为的控制寄存器中cr3 。线性地址中的目录字段确定页目录中指向正确页表的条目。地址的表字段又确定页表中包含页框物理地址的条目，该页框包含该页。偏移字段确定页面框架内的相对位置（参见图 2-7）。因为它是 12 位长，所以每页由 4096 字节数据组成。

The physical address of the Page Directory in use is stored in a control register named cr3 . The Directory field within the linear address determines the entry in the Page Directory that points to the proper Page Table. The address's Table field, in turn, determines the entry in the Page Table that contains the physical address of the page frame containing the page. The Offset field determines the relative position within the page frame (see Figure 2-7). Because it is 12 bits long, each page consists of 4096 bytes of data.

图 2-7。由 80 × 86 处理器进行分页

Figure 2-7. Paging by 80 × 86 processors

目录和表字段都是 10 位长，因此页目录和页表最多可以包含 1,024 个条目。由此可见，页目录最多可以寻址 1024 × 1024 × 4096=2 ^{32 个}内存单元，正如您在 32 位地址中所期望的那样。

Both the Directory and the Table fields are 10 bits long, so Page Directories and Page Tables can include up to 1,024 entries. It follows that a Page Directory can address up to 1024 × 1024 × 4096=2³² memory cells, as you'd expect in 32-bit addresses.

页目录和页表的条目具有相同的结构。每个条目包含以下字段：

The entries of Page Directories and Page Tables have the same structure. Each entry includes the following fields:

从 Pentium 型号开始，80 × 86 微处理器引入了扩展分页功能 ，它允许页框大小为 4 MB 而不是 4 KB（见图2-8）。扩展分页用于将大的连续线性地址范围转换为相应的物理地址范围；在这些情况下，内核可以不需要中间页表，从而节省内存并保留 TLB 条目（请参阅“转换后备缓冲区 (TLB) ”部分）。

Starting with the Pentium model, 80 × 86 microprocessors introduce extended paging , which allows page frames to be 4 MB instead of 4 KB in size (see Figure 2-8). Extended paging is used to translate large contiguous linear address ranges into corresponding physical ones; in these cases, the kernel can do without intermediate Page Tables and thus save memory and preserve TLB entries (see the section "Translation Lookaside Buffers (TLB)").

图 2-8。扩展寻呼

Figure 2-8. Extended paging

正如上一节中提到的，扩展分页是通过设置Page Size页目录条目的标志来启用的。在这种情况下，分页单元将线性地址的 32 位分为两个字段：

As mentioned in the previous section, extended paging is enabled by setting the Page Size flag of a Page Directory entry. In this case, the paging unit divides the 32 bits of a linear address into two fields:

扩展分页的页目录条目与正常分页相同，除了：

Page Directory entries for extended paging are the same as for normal paging, except that:

扩展寻呼与常规寻呼共存；它是通过设置处理器寄存器PSE的标志 来启用的cr4。

Extended paging coexists with regular paging; it is enabled by setting the PSE flag of the cr4 processor register.

寻呼单元使用与分段单元不同的保护方案。虽然 80 × 86 处理器允许段有四种可能的特权级别，但只有两种特权级别与页和页表相关，因为特权是由前面“常规分页User/Supervisor” 部分中提到的标志控制的。当此标志为 0 时，仅当小于 3 时才可以对页面进行寻址（这意味着，对于 Linux，当处理器处于内核模式时）。当该标志为1时，该页总是可以被寻址。CPL

The paging unit uses a different protection scheme from the segmentation unit. While 80 × 86 processors allow four possible privilege levels to a segment, only two privilege levels are associated with pages and Page Tables, because privileges are controlled by the User/Supervisor flag mentioned in the earlier section "Regular Paging." When this flag is 0, the page can be addressed only when the CPL is less than 3 (this means, for Linux, when the processor is in Kernel Mode). When the flag is 1, the page can always be addressed.

此外，与段关联的不是三种类型的访问权限（读、写和执行），而是只有两种类型的访问权限（读和写）与页关联。如果Read/Write页目录或页表项的标志等于0，则对应的页表或页只能读取；否则可以读写。^{[ * ]}

Furthermore, instead of the three types of access rights (Read, Write, and Execute) associated with segments, only two types of access rights (Read and Write) are associated with pages. If the Read/Write flag of a Page Directory or Page Table entry is equal to 0, the corresponding Page Table or page can only be read; otherwise it can be read and written.^[*]

一个简单的例子将有助于阐明常规分页的工作原理。我们假设内核将线性地址空间分配给0x20000000正在0x2003ffff运行的进程。^{[ † ]}该空间由 64 页组成。我们不关心包含页面的页框的物理地址；事实上，其中一些甚至可能不在主内存中。我们只对页表条目的其余字段感兴趣。

A simple example will help in clarifying how regular paging works. Let's assume that the kernel assigns the linear address space between 0x20000000 and 0x2003ffff to a running process.^[†] This space consists of exactly 64 pages. We don't care about the physical addresses of the page frames containing the pages; in fact, some of them might not even be in main memory. We are interested only in the remaining fields of the Page Table entries.

让我们从分配给进程的线性地址的 10 个最高有效位开始，它们被分页单元解释为目录字段。地址以 2 开头，后跟零，因此 10 位都具有相同的值，即 0x080十进制 128。因此，所有地址中的Directory字段指的是进程页目录的第129项。相应的条目必须包含分配给进程的页表的物理地址（见图2-9）。如果没有其他线性地址分配给该进程，则页目录的所有剩余 1,023 个条目都将用零填充。

Let's start with the 10 most significant bits of the linear addresses assigned to the process, which are interpreted as the Directory field by the paging unit. The addresses start with a 2 followed by zeros, so the 10 bits all have the same value, namely 0x080 or 128 decimal. Thus the Directory field in all the addresses refers to the 129th entry of the process Page Directory. The corresponding entry must contain the physical address of the Page Table assigned to the process (see Figure 2-9). If no other linear addresses are assigned to the process, all the remaining 1,023 entries of the Page Directory are filled with zeros.

图 2-9。分页的例子

Figure 2-9. An example of paging

中间 10 位假定的值（即表字段的值）范围为 0 到0x03f，或十进制 0 到 63。因此，只有页表的前 64 个条目是有效的。其余 960 个条目用零填充。

The values assumed by the intermediate 10 bits, (that is, the values of the Table field) range from 0 to 0x03f, or from 0 to 63 decimal. Thus, only the first 64 entries of the Page Table are valid. The remaining 960 entries are filled with zeros.

假设进程需要读取线性地址处的字节0x20021406。该地址由分页单元处理如下：

Suppose that the process needs to read the byte at linear address 0x20021406. This address is handled by the paging unit as follows:

如果页表项Present的标志 0x21被清除，则该页不存在于主存中；在这种情况下，分页单元发出页面错误翻译线性地址时出现异常。每当进程尝试访问由0x20000000和分隔的间隔之外的线性地址时，都会发出相同的异常0x2003ffff，因为未分配给该进程的页表条目都用零填充；特别是，他们的Present旗帜都被清除了。

If the Present flag of the 0x21 entry of the Page Table is cleared, the page is not present in main memory; in this case, the paging unit issues a Page Fault exception while translating the linear address. The same exception is issued whenever the process attempts to access linear addresses outside of the interval delimited by 0x20000000 and 0x2003ffff, because the Page Table entries not assigned to the process are filled with zeros; in particular, their Present flags are all cleared.

处理器支持的 RAM 数量受到连接到地址总线的地址引脚数量的限制。从 80386 到 Pentium 的较旧 Intel 处理器使用 32 位物理地址。理论上，此类系统最多可安装 4 GB RAM；实际上，由于用户态进程的线性地址空间要求，内核无法直接寻址超过 1 GB 的 RAM，我们将在后面的“Linux 中的分页”一节中看到这一点。

The amount of RAM supported by a processor is limited by the number of address pins connected to the address bus. Older Intel processors from the 80386 to the Pentium used 32-bit physical addresses. In theory, up to 4 GB of RAM could be installed on such systems; in practice, due to the linear address space requirements of User Mode processes, the kernel cannot directly address more than 1 GB of RAM, as we will see in the later section "Paging in Linux."

然而，需要同时运行数百或数千个进程的大型服务器需要超过 4 GB 的 RAM，近年来，这给英特尔带来了压力，要求扩大 32 位 80 × 86 支持的 RAM 量建筑学。

However, big servers that need to run hundreds or thousands of processes at the same time require more than 4 GB of RAM, and in recent years this created a pressure on Intel to expand the amount of RAM supported on the 32-bit 80 × 86 architecture.

Intel 通过将其处理器上的地址引脚数量从 32 个增加到 36 个来满足这些要求。从 Pentium Pro 开始，所有 Intel 处理器现在都能够寻址多达 2×36 = ⁶⁴ GB 的 RAM。然而，只有通过引入将 32 位线性地址转换为 36 位物理地址的新分页机制才能利用增加的物理地址范围。

Intel has satisfied these requests by increasing the number of address pins on its processors from 32 to 36. Starting with the Pentium Pro, all Intel processors are now able to address up to 2³⁶ = 64 GB of RAM. However, the increased range of physical addresses can be exploited only by introducing a new paging mechanism that translates 32-bit linear addresses into 36-bit physical ones.

在 Pentium Pro 处理器中，Intel 引入了一种称为物理地址扩展 ( PAE ) 的机制。另一种机制，页面大小扩展（PSE-36），是在Pentium III处理器中引入的，但Linux并没有使用它，我们在本书中不会进一步讨论它。

With the Pentium Pro processor, Intel introduced a mechanism called Physical Address Extension (PAE). Another mechanism, Page Size Extension (PSE-36), was introduced in the Pentium III processor, but Linux does not use it, and we won't discuss it further in this book.

PAE 通过设置控制寄存器中的物理地址扩展 ( PAE) 标志来激活cr4。PS页目录条目中的页大小 ( ) 标志启用大页大小（启用 PAE 时为 2 MB）。

PAE is activated by setting the Physical Address Extension (PAE) flag in the cr4 control register. The Page Size (PS) flag in the page directory entry enables large page sizes (2 MB when PAE is enabled).

Intel 改变了分页机制以支持 PAE。

Intel has changed the paging mechanism in order to support PAE.

总而言之，一旦cr3设置，就可以寻址最多 4 GB 的 RAM。如果我们想要寻址更多 RAM，我们必须在cr3PDPT 中放入新值或更改其内容。然而，PAE 的主要问题是线性地址仍然是 32 位长。这迫使内核程序员重复使用相同的线性地址来映射 RAM 的不同区域。我们将在后面的“ RAM 大小超过 4096 MB 时的最终内核页表”部分中概述当 PAE 启用时 Linux 如何初始化页表显然，PAE并没有扩大进程的线性地址空间，因为它只处理物理地址。而且，只有内核可以修改进程的页表，因此运行在用户态的进程无法使用物理地址大于4GB的空间，另一方面，PAE允许内核利用高达64GB的RAM，从而显着增加系统中的进程数量。

To summarize, once cr3 is set, it is possible to address up to 4 GB of RAM. If we want to address more RAM, we'll have to put a new value in cr3 or change the content of the PDPT. However, the main problem with PAE is that linear addresses are still 32 bits long. This forces kernel programmers to reuse the same linear addresses to map different areas of RAM. We'll sketch how Linux initializes Page Tables when PAE is enabled in the later section, "Final kernel Page Table when RAM size is more than 4096 MB." Clearly, PAE does not enlarge the linear address space of a process, because it deals only with physical addresses. Furthermore, only the kernel can modify the page tables of the processes, thus a process running in User Mode cannot use a physical address space larger than 4 GB. On the other hand, PAE allows the kernel to exploit up to 64 GB of RAM, and thus to increase significantly the number of processes in the system.

正如我们在前面几节中看到的，两级分页通常由 32 位微处理器使用^{[ * ]}。然而，两级分页并不适合采用 64 位体系结构的计算机。让我们用一个思想实验来解释原因：

As we have seen in the previous sections, two-level paging is commonly used by 32-bit microprocessors^[*]. Two-level paging, however, is not suitable for computers that adopt a 64-bit architecture. Let's use a thought experiment to explain why:

首先假设标准页面大小为 4 KB。^{因为1 KB覆盖了2 10个}地址的范围，4 KB覆盖了2 ^12个地址，所以Offset字段是12位。这使得最多 52 位的线性地址可以在表和目录字段之间分配。如果我们现在决定仅使用 64 位中的 48 位进行寻址（此限制为我们留下了舒适的 256 TB 地址空间！），则剩余的 48 × -12 = 36 位将必须在表和目录字段之间分配。如果我们现在决定为这两个字段中的每一个保留 18 位，则每个进程的页目录和页表都应包含 2 ¹⁸条目 — 即超过 256,000 个条目。

Start by assuming a standard page size of 4 KB. Because 1 KB covers a range of 2¹⁰ addresses, 4 KB covers 2¹² addresses, so the Offset field is 12 bits. This leaves up to 52 bits of the linear address to be distributed between the Table and the Directory fields. If we now decide to use only 48 of the 64 bits for addressing (this restriction leaves us with a comfortable 256 TB address space!), the remaining 48-12 = 36 bits will have to be split among Table and the Directory fields. If we now decide to reserve 18 bits for each of these two fields, both the Page Directory and the Page Tables of each process should include 2¹⁸ entries — that is, more than 256,000 entries.

因此，64 位处理器的所有硬件分页系统都使用额外的分页级别。使用的级别数取决于处理器的类型。表 2-4总结了 Linux 支持的一些 64 位平台所使用的硬件分页系统的主要特征。请参阅第 1 章中的“硬件依赖性”部分，了解与平台名称相关的硬件的简短描述。

For that reason, all hardware paging systems for 64-bit processors make use of additional paging levels. The number of levels used depends on the type of processor. Table 2-4 summarizes the main characteristics of the hardware paging systems used by some 64-bit platforms supported by Linux. Please refer to the section "Hardware Dependency" in Chapter 1 for a short description of the hardware associated with the platform name.

正如我们将在本章后面的“ Linux 中的分页”部分中看到的那样，Linux 成功地提供了适合大多数受支持的硬件分页系统的通用分页模型。

As we will see in the section "Paging in Linux" later in this chapter, Linux succeeds in providing a common paging model that fits most of the supported hardware paging systems.

当今的微处理器的时钟速率为几千兆赫，而动态 RAM (DRAM) 芯片的访问时间在数百个时钟周期范围内。这意味着 CPU 在执行需要从 RAM 获取操作数和/或将结果存储到 RAM 的指令时可能会受到相当大的阻碍。

Today's microprocessors have clock rates of several gigahertz, while dynamic RAM (DRAM) chips have access times in the range of hundreds of clock cycles. This means that the CPU may be held back considerably while executing instructions that require fetching operands from RAM and/or storing results into RAM.

引入硬件高速缓存是为了减少 CPU 和 RAM 之间的速度不匹配。它们基于众所周知的 局部性原则 ，它适用于程序和数据结构。这说明由于程序的循环结构以及将相关数据打包到线性数组中，接近最近使用的地址的地址在不久的将来很有可能被使用。因此，引入包含最近使用的代码和数据的更小、更快的存储器是有意义的。为此，80 × 86 架构中引入了一种称为线路的新单元。它由几十个连续字节组成，这些字节以突发模式在慢速 DRAM 和用于实现缓存的快速片上静态 RAM (SRAM) 之间传输。

Hardware cache memories were introduced to reduce the speed mismatch between CPU and RAM. They are based on the well-known locality principle , which holds both for programs and data structures. This states that because of the cyclic structure of programs and the packing of related data into linear arrays, addresses close to the ones most recently used have a high probability of being used in the near future. It therefore makes sense to introduce a smaller and faster memory that contains the most recently used code and data. For this purpose, a new unit called the line was introduced into the 80 × 86 architecture. It consists of a few dozen contiguous bytes that are transferred in burst mode between the slow DRAM and the fast on-chip static RAM (SRAM) used to implement caches.

缓存被细分为行的子集。在一种极端情况下，缓存可以直接映射 ，在这种情况下，主存中的一行始终存储在高速缓存中的完全相同的位置。在另一个极端，缓存是完全关联的 ，这意味着内存中的任何行都可以存储在缓存中的任何位置。但大多数缓存在某种程度上都是 N 路组关联的 ，其中主存的任意一行都可以存储在高速缓存的N行中的任意一行中。例如，一行存储器可以存储在双向组关联高速缓存的两个不同行中。

The cache is subdivided into subsets of lines . At one extreme, the cache can be direct mapped , in which case a line in main memory is always stored at the exact same location in the cache. At the other extreme, the cache is fully associative , meaning that any line in memory can be stored at any location in the cache. But most caches are to some degree N-way set associative , where any line of main memory can be stored in any one of N lines of the cache. For instance, a line of memory can be stored in two different lines of a two-way set associative cache.

如图2-10所示，缓存单元插在分页单元和主存之间。它包括硬件高速缓存和高速缓存控制器。高速缓存存储实际的内存行。高速缓存控制器存储条目数组，高速缓存存储器的每一行一个条目。每个条目都包含一个标签以及一些描述缓存行状态的标志。该标签由一些位组成，这些位允许缓存控制器识别该行当前映射的内存位置。内存物理地址的位通常分为三组：最高有效位对应于标记，中间有效位对应于高速缓存控制器子集索引，最低有效位对应于行内的偏移量。

As shown in Figure 2-10, the cache unit is inserted between the paging unit and the main memory. It includes both a hardware cache memory and a cache controller. The cache memory stores the actual lines of memory. The cache controller stores an array of entries, one entry for each line of the cache memory. Each entry includes a tag and a few flags that describe the status of the cache line. The tag consists of some bits that allow the cache controller to recognize the memory location currently mapped by the line. The bits of the memory's physical address are usually split into three groups: the most significant ones correspond to the tag, the middle ones to the cache controller subset index, and the least significant ones to the offset within the line.

图 2-10。处理器硬件缓存

Figure 2-10. Processor hardware cache

当访问 RAM 存储单元时，CPU 从物理地址中提取子集索引，并将子集中所有行的标记与物理地址的高位进行比较。如果找到与地址高位位相同标记的行，则CPU有缓存命中；否则，它有一个 缓存未命中。

When accessing a RAM memory cell, the CPU extracts the subset index from the physical address and compares the tags of all lines in the subset with the high-order bits of the physical address. If a line with the same tag as the high-order bits of the address is found, the CPU has a cache hit; otherwise, it has a cache miss.

当发生缓存命中时，缓存控制器的行为会有所不同，具体取决于访问类型。对于读操作，控制器从高速缓存行中选择数据并将其传输到CPU寄存器中；RAM不被访问，CPU节省时间，这就是缓存系统被发明的原因。对于写操作，控制器可以实现称为 直写的两种基本策略之一 并回写 。在直写中，控制器始终写入 RAM 和高速缓存行，从而有效地关闭高速缓存以进行写入操作。在回写中，可提供更直接的效率，仅更新高速缓存行，而 RAM 的内容保持不变。当然，回写之后，RAM 最终必须更新。仅当 CPU 执行需要刷新高速缓存条目的指令或发生 FLUSH 硬件信号时（通常在高速缓存未命中之后），高速缓存控制器才将高速缓存行写回 RAM。

When a cache hit occurs, the cache controller behaves differently, depending on the access type. For a read operation, the controller selects the data from the cache line and transfers it into a CPU register; the RAM is not accessed and the CPU saves time, which is why the cache system was invented. For a write operation, the controller may implement one of two basic strategies called write-through and write-back . In a write-through, the controller always writes into both RAM and the cache line, effectively switching off the cache for write operations. In a write-back, which offers more immediate efficiency, only the cache line is updated and the contents of the RAM are left unchanged. After a write-back, of course, the RAM must eventually be updated. The cache controller writes the cache line back into RAM only when the CPU executes an instruction requiring a flush of cache entries or when a FLUSH hardware signal occurs (usually after a cache miss).

当发生高速缓存未命中时，如有必要，高速缓存行将被写入内存，并且正确的行将从 RAM 提取到高速缓存条目中。

When a cache miss occurs, the cache line is written to memory, if necessary, and the correct line is fetched from RAM into the cache entry.

多处理器系统的每个处理器都有一个单独的硬件缓存，因此它们需要额外的硬件电路来同步缓存内容。如图2-11所示，每个CPU都有自己的本地硬件缓存。但现在更新变得更加耗时：每当CPU修改其硬件缓存时，它必须检查其他硬件缓存中是否包含相同的数据；如果是这样，它必须通知另一个CPU用正确的值更新它。此活动通常称为缓存监听 。幸运的是，所有这些都是在硬件级别完成的，与内核无关。

Multiprocessor systems have a separate hardware cache for every processor, and therefore they need additional hardware circuitry to synchronize the cache contents. As shown in Figure 2-11, each CPU has its own local hardware cache. But now updating becomes more time consuming: whenever a CPU modifies its hardware cache, it must check whether the same data is contained in the other hardware cache; if so, it must notify the other CPU to update it with the proper value. This activity is often called cache snooping . Luckily, all this is done at the hardware level and is of no concern to the kernel.

图 2-11。双处理器中的缓存

Figure 2-11. The caches in a dual processor

缓存技术正在迅速发展。例如，第一个奔腾型号包括一个称为 L1 缓存的片上缓存。最近的模型还包括其他更大、更慢的片上缓存，称为 L2 缓存、L3 缓存等。缓存级别之间的一致性是在硬件级别实现的。Linux 忽略这些硬件细节并假设只有一个缓存。

Cache technology is rapidly evolving. For example, the first Pentium models included a single on-chip cache called the L1-cache. More recent models also include other larger, slower on-chip caches called the L2-cache, L3-cache, etc. The consistency between the cache levels is implemented at the hardware level. Linux ignores these hardware details and assumes there is a single cache.

CD的旗帜cr0 处理器寄存器用于启用或禁用高速缓存电路。同一寄存器中的标志NW指定高速缓存是使用直写策略还是回写策略。

The CD flag of the cr0 processor register is used to enable or disable the cache circuitry. The NW flag, in the same register, specifies whether the write-through or the write-back strategy is used for the caches.

奔腾高速缓存的另一个有趣的功能是，它允许操作系统将不同的高速缓存管理策略与每个页帧关联起来。为此，每个页目录和每个页表条目都包括两个标志：PCD （Page Cache Disable），它指定在访问页帧中包含的数据时是否必须启用或禁用高速缓存；( PWTPage Write-Through)，指定在将数据写入页框时是否必须应用回写策略或直写策略。Linux 清除 PCDandPWT所有页目录和页表条目的标志；因此，所有页框都启用缓存，并且始终采用回写策略进行写入。

Another interesting feature of the Pentium cache is that it lets an operating system associate a different cache management policy with each page frame. For this purpose, each Page Directory and each Page Table entry includes two flags: PCD (Page Cache Disable), which specifies whether the cache must be enabled or disabled while accessing data included in the page frame; and PWT (Page Write-Through), which specifies whether the write-back or the write-through strategy must be applied while writing data into the page frame. Linux clears the PCD and PWT flags of all Page Directory and Page Table entries; as a result, caching is enabled for all page frames, and the write-back strategy is always adopted for writing.

除了通用硬件缓存之外，80 × 86 处理器还包括另一个称为转换后备缓冲区( TLB ) 的缓存，以加速线性地址转换。当第一次使用线性地址时，通过慢速访问RAM中的页表来计算相应的物理地址。然后，物理地址被存储在 TLB 条目中，以便可以快速转换对同一线性地址的进一步引用。

Besides general-purpose hardware caches, 80 × 86 processors include another cache called Translation Lookaside Buffers (TLB) to speed up linear address translation. When a linear address is used for the first time, the corresponding physical address is computed through slow accesses to the Page Tables in RAM. The physical address is then stored in a TLB entry so that further references to the same linear address can be quickly translated.

在多处理器系统中，每个CPU都有自己的TLB，称为 CPU的本地TLB 。与硬件缓存相反，TLB的相应条目不需要同步，因为在现有CPU上运行的进程可能将相同的线性地址与不同的物理地址相关联。

In a multiprocessor system, each CPU has its own TLB, called the local TLB of the CPU. Contrary to the hardware cache, the corresponding entries of the TLB need not be synchronized, because processes running on the existing CPUs may associate the same linear address with different physical ones.

当。。。的时候cr3 当CPU的控制寄存器被修改时，硬件会自动使本地TLB的所有条目无效，因为正在使用一组新的页表，并且TLB指向旧数据。

When the cr3 control register of a CPU is modified, the hardware automatically invalidates all entries of the local TLB, because a new set of page tables is in use and the TLBs are pointing to old data.

以下宏简化了页表处理：

The following macros simplify Page Table handling:

pte_t、pmd_t、pud_t、pgd_t分别描述页表、页中间目录、页上层目录和页全局目录条目的格式。当启用 PAE 时，它们是 64 位数据类型，否则为 32 位数据类型。pgprot_t是另一种 64 位（PAE 启用）或 32 位（PAE 禁用）数据类型，表示与单个条目关联的保护标志。

pte_t, pmd_t, pud_t, and pgd_t describe the format of, respectively, a Page Table, a Page Middle Directory, a Page Upper Directory, and a Page Global Directory entry. They are 64-bit data types when PAE is enabled and 32-bit data types otherwise. pgprot_t is another 64-bit (PAE enabled) or 32-bit (PAE disabled) data type that represents the protection flags associated with a single entry.

五个类型转换宏 — _ _ pte、_ _ pmd、_ _ pud、_ _ pgd和_ _ pgprot— 将无符号整数转换为所需类型。其他五个类型转换宏 — pte_val、 pmd_val、pud_val、pgd_val和pgprot_val— 执行从前面提到的四种专用类型之一到无符号整数的反向转换。

Five type-conversion macros — _ _ pte, _ _ pmd, _ _ pud, _ _ pgd, and _ _ pgprot — cast an unsigned integer into the required type. Five other type-conversion macros — pte_val, pmd_val, pud_val, pgd_val, and pgprot_val — perform the reverse casting from one of the four previously mentioned specialized types into an unsigned integer.

内核还提供了几个宏和函数来读取或修改页表条目：

The kernel also provides several macros and functions to read or modify page table entries:

pmd_bad函数使用该宏来检查作为输入参数传递的页面中间目录条目。如果条目指向错误页表，则它会生成值 1 — 也就是说，如果至少满足以下条件之一：

The pmd_bad macro is used by functions to check Page Middle Directory entries passed as input parameters. It yields the value 1 if the entry points to a bad Page Table — that is, if at least one of the following conditions applies:

和宏总是产生 0。没有定义宏，因为页表条目引用主存中不存在、不可写或根本不可访问的页是合法的pud_bad。pgd_badpte_bad

The pud_bad and pgd_bad macros always yield 0. No pte_bad macro is defined, because it is legal for a Page Table entry to refer to a page that is not present in main memory, not writable, or not accessible at all.

如果页表条目的标志或标志等于 1，则宏产生值 1，否则产生值0 pte_present。回想一下， 页表条目中的标志对于微处理器的分页单元没有任何意义；然而，内核将主内存中存在但没有读、写或执行权限的页面标记 为等于 0 和等于 1。这样，对此类页面的任何访问都会触发页面错误PresentPage SizePage SizePresentPage Size因为Present清除了异常，内核可以通过检查 的值来判断故障不是由于缺页引起的Page Size。

The pte_present macro yields the value 1 if either the Present flag or the Page Size flag of a Page Table entry is equal to 1, the value 0 otherwise. Recall that the Page Size flag in Page Table entries has no meaning for the paging unit of the microprocessor; the kernel, however, marks Present equal to 0 and Page Size equal to 1 for the pages present in main memory but without read, write, or execute privileges. In this way, any access to such pages triggers a Page Fault exception because Present is cleared, and the kernel can detect that the fault is not due to a missing page by checking the value of Page Size.

如果相应条目的标志等于 1，也就是说，如果相应的页或页表已加载到主内存中，则宏pmd_present将生成值 1 。Present和pud_present宏pgd_present始终产生值 1。

The pmd_present macro yields the value 1 if the Present flag of the corresponding entry is equal to 1 — that is, if the corresponding page or Page Table is loaded in main memory. The pud_present and pgd_present macros always yield the value 1.

表 2-5中列出的函数查询页表条目中包含的任何标志的当前值；除 之外pte_file()，这些函数仅在返回 1 的页表条目上正常工作pte_present。

The functions listed in Table 2-5 query the current value of any of the flags included in a Page Table entry; with the exception of pte_file(), these functions work properly only on Page Table entries for which pte_present returns 1.

表 2-6中列出的另一组函数设置页表条目中的标志值。

Another group of functions listed in Table 2-6 sets the value of the flags in a Page Table entry.

现在，我们来讨论表2-7中列出的宏，它们将页地址和一组保护标志组合到页表项中，或者执行从页表项中提取页地址的逆操作。请注意，其中一些宏通过“页面描述符”的线性地址（请参阅第 8 章中的“页面描述符”部分）而不是页面本身的线性地址来引用页面。

Now, let's discuss the macros listed in Table 2-7 that combine a page address and a group of protection flags into a page table entry or perform the reverse operation of extracting the page address from a page table entry. Notice that some of these macros refer to a page through the linear address of its "page descriptor" (see the section "Page Descriptors" in Chapter 8) rather than the linear address of the page itself.

这个长列表的最后一组函数是为了简化页表条目的创建和删除而引入的。

The last group of functions of this long list was introduced to simplify the creation and deletion of page table entries.

当两级使用分页时，创建或删除页面中间目录条目很简单。正如我们在本节前面所解释的，页中间目录包含指向从属页表的单个条目。因此，页面中间目录条目 也是页面全局目录内的条目。然而，在处理页表时，创建条目可能会更复杂，因为应该包含它的页表可能不存在。在这种情况下，有必要分配一个新的页框，用零填充它，并添加条目。

When two-level paging is used, creating or deleting a Page Middle Directory entry is trivial. As we explained earlier in this section, the Page Middle Directory contains a single entry that points to the subordinate Page Table. Thus, the Page Middle Directory entry is the entry within the Page Global Directory, too. When dealing with Page Tables, however, creating an entry may be more complex, because the Page Table that is supposed to contain it might not exist. In such cases, it is necessary to allocate a new page frame, fill it with zeros, and add the entry.

如果启用PAE，内核使用三级寻呼。当内核创建新的Page Global Directory时，它还会分配相应的4个Page Middle Directory；仅当父页面全局目录被释放时，它们才会被释放。

If PAE is enabled, the kernel uses three-level paging. When the kernel creates a new Page Global Directory, it also allocates the four corresponding Page Middle Directories; these are freed only when the parent Page Global Directory is released.

当使用两级或三级分页时，页面上层目录条目始终映射为页面全局目录中的单个条目。

When two or three-level paging is used, the Page Upper Directory entry is always mapped as a single entry within the Page Global Directory.

与往常一样，表2-8中列出的功能描述是指80×86架构。

As usual, the description of the functions listed in Table 2-8 refers to the 80 × 86 architecture.

在初始化阶段，内核必须构建 物理地址映射 它指定哪些物理地址范围可供内核使用，哪些不可用（因为它们映射硬件设备的 I/O 共享内存，或者因为相应的页帧包含 BIOS 数据）。

During the initialization phase the kernel must build a physical addresses map that specifies which physical address ranges are usable by the kernel and which are unavailable (either because they map hardware devices' I/O shared memory or because the corresponding page frames contain BIOS data).

内核认为以下页框是 保留的 :

The kernel considers the following page frames as reserved :

保留页框中包含的页永远不能动态分配或交换到磁盘。

A page contained in a reserved page frame can never be dynamically assigned or swapped to disk.

作为一般规则，Linux 内核从物理地址开始安装在 RAM 中0x00100000，即从第二兆字节开始。所需的页框总数取决于内核的配置方式。典型配置产生的内核可以在不到 3 MB 的 RAM 中加载。

As a general rule, the Linux kernel is installed in RAM starting from the physical address 0x00100000 — i.e., from the second megabyte. The total number of page frames required depends on how the kernel is configured. A typical configuration yields a kernel that can be loaded in less than 3 MB of RAM.

为什么内核不从第一个可用的 RAM 开始加载？嗯，PC 架构有几个必须考虑的特性。例如：

Why isn't the kernel loaded starting with the first available megabyte of RAM? Well, the PC architecture has several peculiarities that must be taken into account. For example:

在引导序列的早期阶段（参见附录 A），内核查询 BIOS 并了解物理内存的大小。在最近的计算机中，内核还调用 BIOS 过程来构建物理地址范围及其相应内存类型的列表。

In the early stage of the boot sequence (see Appendix A), the kernel queries the BIOS and learns the size of the physical memory. In recent computers, the kernel also invokes a BIOS procedure to build a list of physical address ranges and their corresponding memory types.

随后，内核执行该machine_specific_memory_setup( )函数，该函数构建物理地址映射（示例请参见表2-9 ）。当然，如果 BIOS 列表可用，内核会根据 BIOS 列表构建此表；否则，内核将按照保守的默认设置构建表：所有编号从 0x9f( LOWMEMSIZE( )) 到0x100( HIGH_MEMORY) 的页框都标记为保留。

Later, the kernel executes the machine_specific_memory_setup( ) function, which builds the physical addresses map (see Table 2-9 for an example). Of course, the kernel builds this table on the basis of the BIOS list, if this is available; otherwise the kernel builds the table following the conservative default setup: all page frames with numbers from 0x9f (LOWMEMSIZE( )) to 0x100 (HIGH_MEMORY) are marked as reserved.

表 2-9显示了具有 128 MB RAM 的计算机的典型配置。物理地址范围从0x07ff0000到0x07ff2fff存储BIOS在POST阶段写入的系统硬件设备的信息；在初始化阶段，内核将这些信息复制到合适的内核数据结构中，然后认为这些页帧可用。0x07ff3000反之， to的物理地址范围0x07ffffff则映射到硬件设备的ROM芯片上。物理地址范围从0xffff0000被标记为保留，因为它由硬件映射到 BIOS 的 ROM 芯片（参见附录 A）。请注意，BIOS 可能不提供某些物理地址范围的信息（在表中，范围是0x000a0000到0x000effff）。为了安全起见，Linux 假设这样的范围不可用。

A typical configuration for a computer having 128 MB of RAM is shown in Table 2-9. The physical address range from 0x07ff0000 to 0x07ff2fff stores information about the hardware devices of the system written by the BIOS in the POST phase; during the initialization phase, the kernel copies such information in a suitable kernel data structure, and then considers these page frames usable. Conversely, the physical address range of 0x07ff3000 to 0x07ffffff is mapped to ROM chips of the hardware devices. The physical address range starting from 0xffff0000 is marked as reserved, because it is mapped by the hardware to the BIOS's ROM chip (see Appendix A). Notice that the BIOS may not provide information for some physical address ranges (in the table, the range is 0x000a0000 to 0x000effff). To be on the safe side, Linux assumes that such ranges are not usable.

内核可能看不到 BIOS 报告的所有物理内存：例如，如果内核未使用 PAE 支持进行编译，则只能寻址 4 GB RAM，即使实际上有大量物理内存可用。该setup_memory( )函数在之后立即调用machine_specific_memory_setup( )：它分析物理内存区域表并初始化一些描述内核物理内存布局的变量。这些变量如表 2-10所示。

The kernel might not see all physical memory reported by the BIOS: for instance, the kernel can address only 4 GB of RAM if it has not been compiled with PAE support, even if a larger amount of physical memory is actually available. The setup_memory( ) function is invoked right after machine_specific_memory_setup( ): it analyzes the table of physical memory regions and initializes a few variables that describe the kernel's physical memory layout. These variables are shown in Table 2-10.

为了避免将内核加载到不连续的页帧组中，Linux 倾向于跳过 RAM 的第一个兆字节。显然，Linux 将使用 PC 体系结构未保留的页框来存储动态分配的页面。

To avoid loading the kernel into groups of noncontiguous page frames, Linux prefers to skip the first megabyte of RAM. Clearly, page frames not reserved by the PC architecture will be used by Linux to store dynamically assigned pages.

图 2-13 显示了 Linux 如何填充前 3 MB RAM。我们假设内核需要少于 3 MB 的 RAM。

Figure 2-13 shows how the first 3 MB of RAM are filled by Linux. We have assumed that the kernel requires less than 3 MB of RAM.

符号_text对应物理地址0x00100000，表示内核代码第一个字节的地址。内核代码的结尾同样由符号 标识_etext。内核数据分为两组： 已初始化和 未初始化。初始化数据从 开始_etext，到 结束_edata。未初始化的数据跟随并结束于_end。

The symbol _text, which corresponds to physical address 0x00100000, denotes the address of the first byte of kernel code. The end of the kernel code is similarly identified by the symbol _etext. Kernel data is divided into two groups: initialized and uninitialized. The initialized data starts right after _etext and ends at _edata. The uninitialized data follows and ends up at _end.

图中出现的符号在Linux源代码中并没有定义；它们是在编译内核时生成的。^{[ * ]}

The symbols appearing in the figure are not defined in Linux source code; they are produced while compiling the kernel.^[*]

图 2-13。Linux 2.6 中的前 768 个页框 (3 MB)

Figure 2-13. The first 768 page frames (3 MB) in Linux 2.6

进程的线性地址空间分为两部分：

The linear address space of a process is divided into two parts:

当进程在用户模式下运行时，它会发出小于0xc0000000; 的线性地址。当它运行在内核模式时，它正在执行内核代码并且发出的线性地址大于或等于0xc0000000。然而，在某些情况下，内核必须访问用户模式线性地址空间来检索或存储数据。

When a process runs in User Mode, it issues linear addresses smaller than 0xc0000000; when it runs in Kernel Mode, it is executing kernel code and the linear addresses issued are greater than or equal to 0xc0000000. In some cases, however, the kernel must access the User Mode linear address space to retrieve or store data.

宏PAGE_OFFSET产生值0xc0000000；这是内核所在进程的线性地址空间中的偏移量。在本书中，我们经常直接引用数字0xc0000000。

The PAGE_OFFSET macro yields the value 0xc0000000; this is the offset in the linear address space of a process where the kernel lives. In this book, we often refer directly to the number 0xc0000000 instead.

映射线性地址低于0xc0000000（禁用 PAE 的前 768 个条目，或启用 PAE 的前 3 个条目）的页面全局目录的第一个条目的内容取决于具体进程。相反，所有进程的其余条目应该相同，并且等于主内核页面全局目录的相应条目（参见下一节）。

The content of the first entries of the Page Global Directory that map linear addresses lower than 0xc0000000 (the first 768 entries with PAE disabled, or the first 3 entries with PAE enabled) depends on the specific process. Conversely, the remaining entries should be the same for all processes and equal to the corresponding entries of the master kernel Page Global Directory (see the following section).

内核维护一组供自己使用的页表，植根于所谓的主内核页面全局目录。系统初始化后，这组页表永远不会被任何进程或内核线程直接使用；相反，主内核页面全局目录的最高条目是系统中每个常规进程的页面全局目录的相应条目的参考模型。

The kernel maintains a set of page tables for its own use, rooted at a so-called master kernel Page Global Directory. After system initialization, this set of page tables is never directly used by any process or kernel thread; rather, the highest entries of the master kernel Page Global Directory are the reference model for the corresponding entries of the Page Global Directories of every regular process in the system.

我们在第 8 章的“非连续内存区域的线性地址”部分中解释了内核如何确保对主内核页面全局目录的更改传播到进程实际使用的页面全局目录。

We explain how the kernel ensures that changes to the master kernel Page Global Directory are propagated to the Page Global Directories that are actually used by processes in the section "Linear Addresses of Noncontiguous Memory Areas" in Chapter 8.

现在我们描述内核如何初始化它自己的页表。这是一个两阶段的活动。事实上，内核映像加载到内存后，CPU 仍然运行在实模式下；因此，未启用分页。

We now describe how the kernel initializes its own page tables. This is a two-phase activity. In fact, right after the kernel image is loaded into memory, the CPU is still running in real mode; thus, paging is not enabled.

在第一阶段，内核创建有限的地址空间，包括内核的代码和数据段、初始页表以及一些动态数据结构的 128 KB。这个最小的地址空间刚好足够在 RAM 中安装内核并初始化其核心数据结构。

In the first phase, the kernel creates a limited address space including the kernel's code and data segments, the initial Page Tables, and 128 KB for some dynamic data structures. This minimal address space is just large enough to install the kernel in RAM and to initialize its core data structures.

在第二阶段，内核利用所有现有的 RAM 并正确设置页表。让我们看看这个计划是如何执行的。

In the second phase, the kernel takes advantage of all of the existing RAM and sets up the page tables properly. Let us examine how this plan is executed.

    movl $swapper_pg_dir-0xc0000000,%eax
    movl %eax,%cr3 /* 设置页表指针.. */
    movl %cr0,%eax
    或 $0x80000000,%eax
    movl %eax,%cr0 /* ..并设置分页（PG）位 */

    movl $swapper_pg_dir-0xc0000000,%eax
    movl %eax,%cr3        /* set the page table pointer.. */
    movl %cr0,%eax
    orl $0x80000000,%eax
    movl %eax,%cr0        /* ..and set paging (PG) bit */

    pgd = swapper_pg_dir + pgd_index(PAGE_OFFSET); /* 768 */
    phys_地址 = 0x00000000;
    while (phys_addr < (max_low_pfn * PAGE_SIZE)) {
        pmd = one_md_table_init(pgd); /* 返回 pgd 本身 */
        set_pmd(pmd, _ _pmd(phys_addr | pgprot_val(_ _pgprot(0x1e3))));
        /* 0x1e3 == 存在、已访问、脏、读/写、
                页面大小，全局 */
                phys_addr += PTRS_PER_PTE * PAGE_SIZE；/* 0x400000 */
         ++pgd；
  }

    pgd = swapper_pg_dir + pgd_index(PAGE_OFFSET); /* 768 */
    phys_addr = 0x00000000;
    while (phys_addr < (max_low_pfn * PAGE_SIZE)) {
        pmd = one_md_table_init(pgd); /* returns pgd itself */
        set_pmd(pmd, _ _pmd(phys_addr | pgprot_val(_ _pgprot(0x1e3))));
        /* 0x1e3 == Present, Accessed, Dirty, Read/Write,
                Page Size, Global */
                phys_addr += PTRS_PER_PTE * PAGE_SIZE; /* 0x400000 */
         ++pgd;
  }

    pgd_idx = pgd_index(PAGE_OFFSET); /* 3 */
    for (i=0; i<pgd_idx; i++)
        set_pgd(swapper_pg_dir + i, _ _pgd(_ _pa(empty_zero_page) + 0x001));
        /* 0x001 == 现在 */
    pgd = swapper_pg_dir + pgd_idx;
    phys_地址 = 0x00000000;
    for (; i<PTRS_PER_PGD; ++i, ++pgd) {
        pmd = (pmd_t *) alloc_bootmem_low_pages(PAGE_SIZE);
        set_pgd(pgd, _ _pgd(_ _pa(pmd) | 0x001)); /* 0x001 == 现在 */
        if (phys_addr < max_low_pfn * PAGE_SIZE)
            for (j=0; j < PTRS_PER_PMD /* 512 */
                  && phys_addr < max_low_pfn*PAGE_SIZE; ++j) {
                set_pmd（pmd，_ _pmd（phys_addr |
                               pgprot_val(_ _pgprot(0x1e3))));
                /* 0x1e3 == 存在、已访问、脏、读/写、
                        页面大小，全局 */
                phys_addr += PTRS_PER_PTE * PAGE_SIZE；/* 0x200000 */
          }
    }
    swapper_pg_dir[0] = swapper_pg_dir[pgd_idx];

    pgd_idx = pgd_index(PAGE_OFFSET); /* 3 */
    for (i=0; i<pgd_idx; i++)
        set_pgd(swapper_pg_dir + i, _ _pgd(_ _pa(empty_zero_page) + 0x001));
        /* 0x001 == Present */
    pgd = swapper_pg_dir + pgd_idx;
    phys_addr = 0x00000000;
    for (; i<PTRS_PER_PGD; ++i, ++pgd) {
        pmd = (pmd_t *) alloc_bootmem_low_pages(PAGE_SIZE);
        set_pgd(pgd, _ _pgd(_ _pa(pmd) | 0x001)); /* 0x001 == Present */
        if (phys_addr < max_low_pfn * PAGE_SIZE)
            for (j=0; j < PTRS_PER_PMD /* 512 */
                  && phys_addr < max_low_pfn*PAGE_SIZE; ++j) {
                set_pmd(pmd, _ _pmd(phys_addr |
                               pgprot_val(_ _pgprot(0x1e3))));
                /* 0x1e3 == Present, Accessed, Dirty, Read/Write,
                        Page Size, Global */
                phys_addr += PTRS_PER_PTE * PAGE_SIZE; /* 0x200000 */
          }
    }
    swapper_pg_dir[0] = swapper_pg_dir[pgd_idx];

我们看到第四GB内核线性地址的初始部分映射了系统的物理内存。但是，至少 128 MB 的线性地址始终可用，因为内核使用它们来实现非连续内存分配和固定映射线性地址。

We saw that the initial part of the fourth gigabyte of kernel linear addresses maps the physical memory of the system. However, at least 128 MB of linear addresses are always left available because the kernel uses them to implement noncontiguous memory allocation and fix-mapped linear addresses.

非连续内存分配只是动态分配和释放内存页的一种特殊方式，在第8章“非连续内存区域的线性地址”一节中进行了描述。在本节中，我们重点讨论固定映射的线性地址。

Noncontiguous memory allocation is just a special way to dynamically allocate and release pages of memory, and is described in the section "Linear Addresses of Noncontiguous Memory Areas" in Chapter 8. In this section, we focus on fix-mapped linear addresses.

基本上，固定映射线性地址是一个恒定的线性地址，0xffffc000其对应的物理地址不必是线性地址 minus 0xc000000，而是以任意方式设置的物理地址。因此，每个固定映射的线性地址映射物理存储器的一个页帧。正如我们将在后面的章节中看到的，内核使用固定映射的线性地址而不是永远不会改变其值的指针变量。

Basically, a fix-mapped linear address is a constant linear address like 0xffffc000 whose corresponding physical address does not have to be the linear address minus 0xc000000, but rather a physical address set in an arbitrary way. Thus, each fix-mapped linear address maps one page frame of the physical memory. As we'll see in later chapters, the kernel uses fix-mapped linear addresses instead of pointer variables that never change their value.

固定映射线性地址在概念上类似于映射前 896 MB RAM 的线性地址。然而，固定映射的线性地址可以映射任何物理地址，而由第四GB的初始部分中的线性地址建立的映射是线性的(线性地址X 映射物理地址X-PAGE_OFFSET )。

Fix-mapped linear addresses are conceptually similar to the linear addresses that map the first 896 MB of RAM. However, a fix-mapped linear address can map any physical address, while the mapping established by the linear addresses in the initial portion of the fourth gigabyte is linear (linear address X maps physical address X-PAGE_OFFSET).

相对于变量指针，固定映射的线性地址更有效。事实上，取消引用变量指针比取消引用立即常量地址需要多一次内存访问。此外，在取消引用变量指针之前检查它的值是一种很好的编程习惯；相反，对于恒定的线性地址则不需要检查。

With respect to variable pointers, fix-mapped linear addresses are more efficient. In fact, dereferencing a variable pointer requires one memory access more than dereferencing an immediate constant address. Moreover, checking the value of a variable pointer before dereferencing it is a good programming practice; conversely, the check is never required for a constant linear address.

每个固定映射的线性地址都由数据结构中定义的一个小整数索引表示enum fixed_addresses：

Each fix-mapped linear address is represented by a small integer index defined in the enum fixed_addresses data structure:

    枚举固定地址{
        修复孔，
        FIX_VSYSCALL，
        FIX_APIC_BASE，
        FIX_IO_APIC_BASE_0，
        [...]
        _ _固定地址结束
    };

    enum fixed_addresses {
        FIX_HOLE,
        FIX_VSYSCALL,
        FIX_APIC_BASE,
        FIX_IO_APIC_BASE_0,
        [...]
        _ _end_of_fixed_addresses
    };

固定映射线性地址放置在第四 GB 线性地址的末尾。该fix_to_virt( )函数计算从索引开始的常量线性地址：

Fix-mapped linear addresses are placed at the end of the fourth gigabyte of linear addresses. The fix_to_virt( ) function computes the constant linear address starting from the index:

    内联无符号长 fix_to_virt(const unsigned int idx)
    {
    if (idx >= _ _固定地址结束符)
        _ _this_fixmap_does_not_exist( );
        返回 (0xfffff000UL - (idx << PAGE_SHIFT));
    }

    inline unsigned long fix_to_virt(const unsigned int idx)
    {
    if (idx >= _ _end_of_fixed_addresses)
        _ _this_fixmap_does_not_exist( );
        return (0xfffff000UL - (idx << PAGE_SHIFT));
    }

我们假设某个内核函数调用fix_to_virt(FIX_IOAPIC_BASE_0). 由于该函数被声明为“内联”，因此 C 编译器不会生成对 的调用fix_to_virt( )，而是将其代码插入到调用函数中。此外，对索引值的检查永远不会在运行时执行。事实上，FIX_IOAPIC_BASE_0是一个等于 3 的常量，因此编译器可以删除该if 语句，因为它的条件在编译时为 false。相反，如果条件为真或 的参数fix_to_virt( )不是常量，则编译器会在链接阶段发出错误，因为该符号 _ _this_fixmap_does_not_exist未在任何地方定义。最终，编译器计算0xfffff000-(3<<PAGE_SHIFT)并替换fix_to_virt( ) 使用常量线性地址调用函数0xffffc000。

Let's assume that some kernel function invokes fix_to_virt(FIX_IOAPIC_BASE_0). Because the function is declared as "inline," the C compiler does not generate a call to fix_to_virt( ), but inserts its code in the calling function. Moreover, the check on the index value is never performed at runtime. In fact, FIX_IOAPIC_BASE_0 is a constant equal to 3, so the compiler can cut away the if statement because its condition is false at compile time. Conversely, if the condition is true or the argument of fix_to_virt( ) is not a constant, the compiler issues an error during the linking phase because the symbol _ _this_fixmap_does_not_exist is not defined anywhere. Eventually, the compiler computes 0xfffff000-(3<<PAGE_SHIFT) and replaces the fix_to_virt( ) function call with the constant linear address 0xffffc000.

为了将物理地址与固定映射的线性地址相关联，内核使用set_fixmap(idx,phys)和set_fixmap_nocache(idx,phys)宏。两者都是fix_to_virt(idx)用物理地址初始化线性地址对应的页表项phys；然而，第二个函数还设置页表条目的标志，从而在访问页帧中的数据时禁用硬件缓存（参见本章前面的“硬件缓存PCD” 部分）。相反，删除固定映射线性地址和物理地址之间的链接。clear_fixmap(idx)idx

To associate a physical address with a fix-mapped linear address, the kernel uses the set_fixmap(idx,phys) and set_fixmap_nocache(idx,phys) macros. Both of them initialize the Page Table entry corresponding to the fix_to_virt(idx) linear address with the physical address phys; however, the second function also sets the PCD flag of the Page Table entry, thus disabling the hardware cache when accessing the data in the page frame (see the section "Hardware Cache" earlier in this chapter). Conversely, clear_fixmap(idx) removes the linking between a fix-mapped linear address idx and the physical address.

内存寻址的最后一个主题涉及内核如何优化使用硬件缓存。硬件缓存和转换后备缓冲区在提高现代计算机体系结构的性能方面发挥着至关重要的作用。内核开发人员使用多种技术来减少缓存和 TLB 未命中的数量。

The last topic of memory addressing deals with how the kernel makes an optimal use of the hardware caches. Hardware caches and Translation Lookaside Buffers play a crucial role in boosting the performance of modern computer architectures. Several techniques are used by kernel developers to reduce the number of cache and TLB misses.